{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "govulncheck/vex:948b541d73a6613e40b41d1bb5775d3702f0470ba7720db326cb50c958249e93",
  "author": "Unknown Author",
  "timestamp": "2026-09-15T15:20:45.067471798Z",
  "version": 1,
  "tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",
  "statements": [
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4517",
        "name": "GO-2026-4517",
        "description": "Kata Container to Guest micro VM privilege escalation in github.com/kata-containers/kata-containers/src/runtime",
        "aliases": [
          "CVE-2026-24834",
          "GHSA-wwj6-vghv-5p64"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fkata-containers%2Fkata-containers%2Fsrc%2Fruntime@v0.0.0-20250828155603-754f07cff239"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-4970",
        "name": "GO-2026-4970",
        "description": "Root escape via symlink plus trailing slash in os",
        "aliases": [
          "CVE-2026-39822"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5026",
        "name": "GO-2026-5026",
        "description": "Invoking failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna",
        "aliases": [
          "CVE-2026-39821"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5064",
        "name": "GO-2026-5064",
        "description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53492",
          "GHSA-33vj-92qq-66hc"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5338",
        "name": "GO-2026-5338",
        "description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-50195",
          "GHSA-cvxm-645q-p574"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5622",
        "name": "GO-2026-5622",
        "description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd",
        "aliases": [
          "CVE-2026-53489",
          "GHSA-rgh6-rfwx-v388"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/github.com%2Fcontainerd%2Fcontainerd@v1.7.35"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5856",
        "name": "GO-2026-5856",
        "description": "Invoking Encrypted Client Hello privacy leak in crypto/tls",
        "aliases": [
          "CVE-2026-42505"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5932",
        "name": "GO-2026-5932",
        "description": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues"
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5942",
        "name": "GO-2026-5942",
        "description": "Parsing an invalid SVCB or HTTPS RR can panic in golang.org/x/net/dns/dnsmessage",
        "aliases": [
          "CVE-2026-46600"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-5972",
        "name": "GO-2026-5972",
        "description": "Enforce maximum recursion depth in encoding/asn1",
        "aliases": [
          "CVE-2026-33818"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6088",
        "name": "GO-2026-6088",
        "description": "Add recursion depth guard during decode in encoding/xml",
        "aliases": [
          "CVE-2026-56859"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6089",
        "name": "GO-2026-6089",
        "description": "Apply ReadHeaderTimeout when doing unencrypted HTTP/2 check in net/http",
        "aliases": [
          "CVE-2026-56853"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6090",
        "name": "GO-2026-6090",
        "description": "Limit handshake messages we are willing to accept post-handshake in crypto/tls",
        "aliases": [
          "CVE-2026-56862"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6091",
        "name": "GO-2026-6091",
        "description": "Fix Javascript regexp context tracking in html/template",
        "aliases": [
          "CVE-2026-56858"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6179",
        "name": "GO-2026-6179",
        "description": "Fix transparency log tile verification bypass in golang.org/x/mod/sumdb/tlog",
        "aliases": [
          "CVE-2026-56865"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fmod@v0.38.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6180",
        "name": "GO-2026-6180",
        "description": "Ignore unrelated, unauthenticated hashes in Lookup in golang.org/x/mod/sumdb",
        "aliases": [
          "CVE-2026-56864"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fmod@v0.38.0"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "Govulncheck determined that the vulnerable code isn't called"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6218",
        "name": "GO-2026-6218",
        "description": "Avoid quadratic complexity in resolvePath in net/url",
        "aliases": [
          "CVE-2026-56860"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/stdlib@v1.26.4"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6354",
        "name": "GO-2026-6354",
        "description": "Prevent DoS on deadlocked undecided channel in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-78662"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    },
    {
      "vulnerability": {
        "@id": "https://pkg.go.dev/vuln/GO-2026-6355",
        "name": "GO-2026-6355",
        "description": "Prevent DoS on deadlocked established channel in golang.org/x/crypto/ssh",
        "aliases": [
          "CVE-2026-56855"
        ]
      },
      "products": [
        {
          "@id": "Unknown Product",
          "subcomponents": [
            {
              "@id": "pkg:golang/golang.org%2Fx%2Fcrypto@v0.55.0"
            }
          ]
        }
      ],
      "status": "affected"
    }
  ]
}