{"schema_version":"1.7.5","id":"GO-2026-4821","published":"2026-03-26T20:33:02Z","modified":"2026-03-26T21:03:43.735276Z","aliases":["CVE-2026-33621","GHSA-j65m-hv65-r264"],"summary":"PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token in github.com/pinchtab/pinchtab","details":"PinchTab: Unapplied Rate Limiting Middleware Allows Unbounded Brute-Force of API Token in github.com/pinchtab/pinchtab","affected":[{"package":{"name":"github.com/pinchtab/pinchtab","ecosystem":"Go","purl":"pkg:golang/github.com/pinchtab/pinchtab"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.7"},{"fixed":"0.8.5"}]}],"ecosystem_specific":{},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-4821.json"}}],"references":[{"type":"ADVISORY","url":"https://github.com/pinchtab/pinchtab/security/advisories/GHSA-j65m-hv65-r264"},{"type":"FIX","url":"https://github.com/pinchtab/pinchtab/commit/c619c43a4f29d1d1a481e859c193baf78e0d648b"}],"database_specific":{"review_status":"UNREVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-4821"}}