{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:6ddac6115457a4acf8a99bd449b20d277d198662dd77317da6ad9ef15b346efc",
  "author": "Unknown Author",
  "timestamp": "2026-10-30T00:13:08.056521343Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5064",
        "name": "GO-2026-5064",
        "description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5338",
        "name": "GO-2026-5338",
        "description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5622",
        "name": "GO-2026-5622",
        "description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5932",
        "name": "GO-2026-5932",
        "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.57.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6597",
        "name": "GO-2026-6597",
        "description": "Containerd has image-pull DoS via crafted OCI index graph amplification in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53493",
          "GHSA-pg57-6jwg-q645"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6791",
        "name": "GO-2026-6791",
        "description": "containerd CRI plugin: Checkpoint restore bypasses destination security context in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-95837",
          "GHSA-p7v4-vr35-mj6f"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6809",
        "name": "GO-2026-6809",
        "description": "Distrust compromised intermediate certificates in crypto/x509",
        "aliases": [
          "CVE-2026-111943"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.27.2"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6860",
        "name": "GO-2026-6860",
        "description": "Avoid quadratic complexity when coalescing text nodes in html in golang.org/x/net",
        "aliases": [
          "CVE-2026-78661"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.60.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6866",
        "name": "GO-2026-6866",
        "description": "Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net",
        "aliases": [
          "CVE-2026-97045"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.60.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    }
  ]
}