{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:d76a6578a0dd9e88524c7e739f7f7ac30c58fd494a942289e5eab30c32f88c3a",
  "author": "Unknown Author",
  "timestamp": "2026-08-03T00:28:34.685822903Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4883",
        "name": "GO-2026-4883",
        "description": "Moby has an Off-by-one error in its plugin privilege validation in github.com/docker/docker",
        "aliases": [
          "CVE-2026-33997",
          "GHSA-pxq6-2prw-chj9"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4887",
        "name": "GO-2026-4887",
        "description": "Moby has AuthZ plugin bypass when provided oversized request bodies in github.com/docker/docker",
        "aliases": [
          "CVE-2026-34040",
          "GHSA-x744-4wpc-v9h2"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4970",
        "name": "GO-2026-4970",
        "description": "Root escape via symlink plus trailing slash in os",
        "aliases": [
          "CVE-2026-39822"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5025",
        "name": "GO-2026-5025",
        "description": "Invoking incorrect handling of namespaced elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42506"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5026",
        "name": "GO-2026-5026",
        "description": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
        "aliases": [
          "CVE-2026-39821"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5027",
        "name": "GO-2026-5027",
        "description": "Invoking incorrect handling of HTML elements in foreign content in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-42502"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5028",
        "name": "GO-2026-5028",
        "description": "Invoking denial of service when parsing arbitrary HTML in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25680"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5029",
        "name": "GO-2026-5029",
        "description": "Invoking incorrect handling of character references in DOCTYPE nodes in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-25681"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5030",
        "name": "GO-2026-5030",
        "description": "Invoking duplicate attributes can cause XSS in golang.org/x/net/html",
        "aliases": [
          "CVE-2026-27136"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5064",
        "name": "GO-2026-5064",
        "description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5074",
        "name": "GO-2026-5074",
        "description": "Go-git: Improper parsing of specially crafted objects may lead to inconsistent interpretation in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45022",
          "GHSA-389r-gv7p-r3rp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.18.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5158",
        "name": "GO-2026-5158",
        "description": "Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel",
        "aliases": [
          "CVE-2026-41178",
          "GHSA-5wrp-cwcj-q835"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/go.opentelemetry.io%2Fotel@v1.43.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5336",
        "name": "GO-2026-5336",
        "description": "Go-git: Crafted repositories may modify main and submodule .git directories in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45571",
          "GHSA-crhj-59gh-8x96"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.18.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5338",
        "name": "GO-2026-5338",
        "description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5378",
        "name": "GO-2026-5378",
        "description": "containerd user ID handling bypass allows runAsNonRoot evasion in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-46680",
          "GHSA-fqw6-gf59-qr4w"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5475",
        "name": "GO-2026-5475",
        "description": "containerd image-triggered runtime DoS via unbounded group parsing in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-47262",
          "GHSA-jpcc-p29g-p8mq"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5490",
        "name": "GO-2026-5490",
        "description": "Go-billy: Symlink resolution lack of cycle detection leads to infinite loop in github.com/go-git/go-billy",
        "aliases": [
          "CVE-2026-44740",
          "GHSA-m3xc-h892-ggx6"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-billy%2Fv5@v5.8.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5496",
        "name": "GO-2026-5496",
        "description": "Improper single-quote escaping in go-git SSH transport in github.com/go-git/go-git",
        "aliases": [
          "CVE-2026-45570",
          "GHSA-m7cr-m3pv-hgrp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.18.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5597",
        "name": "GO-2026-5597",
        "description": "Go-billy has path traversal vulnerabilities in github.com/go-git/go-billy",
        "aliases": [
          "CVE-2026-44973",
          "GHSA-qw64-3x98-g7q2"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-billy%2Fv5@v5.8.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5617",
        "name": "GO-2026-5617",
        "description": "Race condition in 'docker cp' in github.com/docker/docker allows bind mount redirection",
        "aliases": [
          "CVE-2026-42306",
          "GHSA-rg2x-37c3-w2rh"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5622",
        "name": "GO-2026-5622",
        "description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5668",
        "name": "GO-2026-5668",
        "description": "Docker: Race condition in docker cp allows creation of arbitrary empty files on the host via symlink swap in github.com/docker/docker",
        "aliases": [
          "CVE-2026-41568",
          "GHSA-vp62-88p7-qqf5"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5693",
        "name": "GO-2026-5693",
        "description": "Go-git: Malformed Git object data may cause panics or resource exhaustion in github.com/go-git/go-git",
        "aliases": [
          "GHSA-w5pp-99ch-qj29"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-git%2Fgo-git%2Fv5@v5.18.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5746",
        "name": "GO-2026-5746",
        "description": "Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker",
        "aliases": [
          "CVE-2026-41567",
          "GHSA-x86f-5xw2-fm2r"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fdocker%2Fdocker@v28.5.2+incompatible"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5758",
        "name": "GO-2026-5758",
        "description": "containerd CRI — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53488",
          "GHSA-xhf5-7wjv-pqxp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.31"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5761",
        "name": "GO-2026-5761",
        "description": "Malicious image with /dev symlink can trigger limited host filesystem integrity violations in github.com/opencontainers/runc",
        "aliases": [
          "CVE-2026-41579",
          "GHSA-xjvp-4fhw-gc47"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fopencontainers%2Frunc@v1.4.1"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5774",
        "name": "GO-2026-5774",
        "description": "Chi has an IP spoofing vulnerability in middleware.RealIP in github.com/go-chi/chi",
        "aliases": [
          "GHSA-3fxj-6jh8-hvhx"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5775",
        "name": "GO-2026-5775",
        "description": "Chi Middleware vulnerable to IP spoofing via X-Forwarded-For header in github.com/go-chi/chi",
        "aliases": [
          "GHSA-9g5q-2w5x-hmxf"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5777",
        "name": "GO-2026-5777",
        "description": "Chi's RealIP Middleware allows IP spoofing via unvalidated X-Forwarded-For header in github.com/go-chi/chi",
        "aliases": [
          "GHSA-rjr7-jggh-pgcp"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fgo-chi%2Fchi%2Fv5@v5.2.5"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5841",
        "name": "GO-2026-5841",
        "description": "OOB read in github.com/klauspost/compress/s2",
        "aliases": [
          "GHSA-259r-337f-4rfw"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fklauspost%2Fcompress@v1.18.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5853",
        "name": "GO-2026-5853",
        "description": "Fulcio has OIDC Discovery Redirect Following Allows SSRF and JWKS Substitution for Meta-Issuer Paths, with Kubernetes Service-Account Token Leakage in github.com/sigstore/fulcio",
        "aliases": [
          "CVE-2026-49478",
          "GHSA-f5mr-q85p-6hh6"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fsigstore%2Ffulcio@v1.8.5"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5856",
        "name": "GO-2026-5856",
        "description": "Invoking Encrypted Client Hello privacy leak in crypto/tls",
        "aliases": [
          "CVE-2026-42505"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5932",
        "name": "GO-2026-5932",
        "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.52.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5942",
        "name": "GO-2026-5942",
        "description": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage",
        "aliases": [
          "CVE-2026-46600"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fnet@v0.54.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5970",
        "name": "GO-2026-5970",
        "description": "Infinite loop on invalid input in golang.org/x/text",
        "aliases": [
          "CVE-2026-56852"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Ftext@v0.37.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6061",
        "name": "GO-2026-6061",
        "description": "Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc",
        "aliases": [
          "GHSA-hrxh-6v49-42gf"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/google.golang.org%2Fgrpc@v1.80.0"
            }
          ]
        }
      ],
      "status": "affected"
    }
  ]
}