{
  "vulnerabilities": [
    {
      "id": "SNYK-ALPINE324-BIND-20154246",
      "cpes": [],
      "title": "CVE-2026-81563",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81563",
          "title": "https://kb.isc.org/docs/cve-2026-81563"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nA BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81563](https://kb.isc.org/docs/cve-2026-81563)\n",
      "epssDetails": {
        "percentile": "0.45166",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81563"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:19:58.993663Z",
      "disclosureTime": "2026-09-16T14:17:10.543000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:19:59.002868Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:40.231422Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154249",
      "cpes": [],
      "title": "CVE-2026-81736",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81736",
          "title": "https://kb.isc.org/docs/cve-2026-81736"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81736](https://kb.isc.org/docs/cve-2026-81736)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81736"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:10.663220Z",
      "disclosureTime": "2026-09-16T14:17:10.817000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:10.665741Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:41.078938Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154251",
      "cpes": [],
      "title": "CVE-2026-19667",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19667",
          "title": "https://kb.isc.org/docs/cve-2026-19667"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19667](https://kb.isc.org/docs/cve-2026-19667)\n",
      "epssDetails": {
        "percentile": "0.45110",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19667"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:13.528005Z",
      "disclosureTime": "2026-09-16T14:17:05.037000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:13.531577Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:36.610533Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154254",
      "cpes": [],
      "title": "CVE-2026-80274",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-80274",
          "title": "https://kb.isc.org/docs/cve-2026-80274"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-80274](https://kb.isc.org/docs/cve-2026-80274)\n",
      "epssDetails": {
        "percentile": "0.45111",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-80274"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:18.021433Z",
      "disclosureTime": "2026-09-16T15:17:52.690000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:18.025162Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:04.068974Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154256",
      "cpes": [],
      "title": "CVE-2026-76163",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-76163",
          "title": "https://kb.isc.org/docs/cve-2026-76163"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf BIND is loaded with a &#34;`named.conf`&#34; file that contains no global &#34;`options`&#34; block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-76163](https://kb.isc.org/docs/cve-2026-76163)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-76163"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:26.841391Z",
      "disclosureTime": "2026-09-16T15:17:43.847000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:26.844273Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:20.730473Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154257",
      "cpes": [],
      "title": "CVE-2026-19666",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19666",
          "title": "https://kb.isc.org/docs/cve-2026-19666"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nOn a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19666](https://kb.isc.org/docs/cve-2026-19666)\n",
      "epssDetails": {
        "percentile": "0.44692",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19666"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:37.670794Z",
      "disclosureTime": "2026-09-16T15:17:33.520000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:37.674026Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-09-27T02:20:37.870447Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154259",
      "cpes": [],
      "title": "CVE-2026-77692",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-77692",
          "title": "https://kb.isc.org/docs/cve-2026-77692"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nAn attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-77692](https://kb.isc.org/docs/cve-2026-77692)\n",
      "epssDetails": {
        "percentile": "0.93618",
        "probability": "0.06558",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-77692"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:47.914852Z",
      "disclosureTime": "2026-09-16T14:17:09.647000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:47.918189Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:23.816057Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-libs@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154246",
      "cpes": [],
      "title": "CVE-2026-81563",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81563",
          "title": "https://kb.isc.org/docs/cve-2026-81563"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nA BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81563](https://kb.isc.org/docs/cve-2026-81563)\n",
      "epssDetails": {
        "percentile": "0.45166",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81563"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:19:58.993663Z",
      "disclosureTime": "2026-09-16T14:17:10.543000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:19:59.002868Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:40.231422Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154249",
      "cpes": [],
      "title": "CVE-2026-81736",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81736",
          "title": "https://kb.isc.org/docs/cve-2026-81736"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81736](https://kb.isc.org/docs/cve-2026-81736)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81736"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:10.663220Z",
      "disclosureTime": "2026-09-16T14:17:10.817000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:10.665741Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:41.078938Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154251",
      "cpes": [],
      "title": "CVE-2026-19667",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19667",
          "title": "https://kb.isc.org/docs/cve-2026-19667"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19667](https://kb.isc.org/docs/cve-2026-19667)\n",
      "epssDetails": {
        "percentile": "0.45110",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19667"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:13.528005Z",
      "disclosureTime": "2026-09-16T14:17:05.037000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:13.531577Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:36.610533Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154254",
      "cpes": [],
      "title": "CVE-2026-80274",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-80274",
          "title": "https://kb.isc.org/docs/cve-2026-80274"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-80274](https://kb.isc.org/docs/cve-2026-80274)\n",
      "epssDetails": {
        "percentile": "0.45111",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-80274"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:18.021433Z",
      "disclosureTime": "2026-09-16T15:17:52.690000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:18.025162Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:04.068974Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154256",
      "cpes": [],
      "title": "CVE-2026-76163",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-76163",
          "title": "https://kb.isc.org/docs/cve-2026-76163"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf BIND is loaded with a &#34;`named.conf`&#34; file that contains no global &#34;`options`&#34; block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-76163](https://kb.isc.org/docs/cve-2026-76163)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-76163"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:26.841391Z",
      "disclosureTime": "2026-09-16T15:17:43.847000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:26.844273Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:20.730473Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154257",
      "cpes": [],
      "title": "CVE-2026-19666",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19666",
          "title": "https://kb.isc.org/docs/cve-2026-19666"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nOn a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19666](https://kb.isc.org/docs/cve-2026-19666)\n",
      "epssDetails": {
        "percentile": "0.44692",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19666"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:37.670794Z",
      "disclosureTime": "2026-09-16T15:17:33.520000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:37.674026Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-09-27T02:20:37.870447Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154259",
      "cpes": [],
      "title": "CVE-2026-77692",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-77692",
          "title": "https://kb.isc.org/docs/cve-2026-77692"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nAn attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-77692](https://kb.isc.org/docs/cve-2026-77692)\n",
      "epssDetails": {
        "percentile": "0.93618",
        "probability": "0.06558",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-77692"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:47.914852Z",
      "disclosureTime": "2026-09-16T14:17:09.647000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:47.918189Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:23.816057Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0",
        "bind/bind-libs@9.20.27-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "bind/bind-libs",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154246",
      "cpes": [],
      "title": "CVE-2026-81563",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81563",
          "title": "https://kb.isc.org/docs/cve-2026-81563"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:01.070688Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:26.458624Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.299433Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nA BIND resolver encountering an SVCB/HTTPS AliasMode record referencing 14 or more SVCB/HTTPS ServiceMode records may fail to properly deallocate internal resources. If this happens repeatedly, resource exhaustion will eventually prevent the resolver from performing new recursive lookups.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81563](https://kb.isc.org/docs/cve-2026-81563)\n",
      "epssDetails": {
        "percentile": "0.45166",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81563"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:19:58.993663Z",
      "disclosureTime": "2026-09-16T14:17:10.543000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:19:59.002868Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:40.231422Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154249",
      "cpes": [],
      "title": "CVE-2026-81736",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-81736",
          "title": "https://kb.isc.org/docs/cve-2026-81736"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:03.370726Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:37.572703Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.703113Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver has cached a tree of SVCB/HTTPS AliasMode records, and is then queried for the root of that tree, the resolver will spend disproportionate CPU time constructing the response.\nThis issue affects BIND 9 versions 9.18.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.18.11-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-81736](https://kb.isc.org/docs/cve-2026-81736)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-81736"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:10.663220Z",
      "disclosureTime": "2026-09-16T14:17:10.817000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:10.665741Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:03:41.078938Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154251",
      "cpes": [],
      "title": "CVE-2026-19667",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19667",
          "title": "https://kb.isc.org/docs/cve-2026-19667"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:29:59.216315Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:54.712472Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.317825Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf an attacker-controlled authoritative server can produce a negative answer that is exactly 65536 bytes, then a flaw in `named` results in a negative cache entry of 0 bytes. When this entry is subsequently read, `named` aborts.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19667](https://kb.isc.org/docs/cve-2026-19667)\n",
      "epssDetails": {
        "percentile": "0.45110",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19667"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:13.528005Z",
      "disclosureTime": "2026-09-16T14:17:05.037000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:13.531577Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:36.610533Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154254",
      "cpes": [],
      "title": "CVE-2026-80274",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-80274",
          "title": "https://kb.isc.org/docs/cve-2026-80274"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:11.191123Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:30.495730Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.742781Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf a BIND resolver sends a query for a DNSSEC-signed authoritative zone, and the authoritative server replies with a valid wildcard answer and signed NSEC3 proof, followed by an unsigned NSEC at the same owner name, it will trigger an unexpected program exit.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-80274](https://kb.isc.org/docs/cve-2026-80274)\n",
      "epssDetails": {
        "percentile": "0.45111",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-80274"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:18.021433Z",
      "disclosureTime": "2026-09-16T15:17:52.690000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:18.025162Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-02T14:04:04.068974Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154256",
      "cpes": [],
      "title": "CVE-2026-76163",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-76163",
          "title": "https://kb.isc.org/docs/cve-2026-76163"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:15.694131Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:36.826831Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:58.477265Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIf BIND is loaded with a &#34;`named.conf`&#34; file that contains no global &#34;`options`&#34; block, an attacker can send a query of QTYPE TKEY which may cause an assertion failure and subsequent unexpected program exit.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-76163](https://kb.isc.org/docs/cve-2026-76163)\n",
      "epssDetails": {
        "percentile": "0.45165",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-76163"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:26.841391Z",
      "disclosureTime": "2026-09-16T15:17:43.847000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:26.844273Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:20.730473Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154257",
      "cpes": [],
      "title": "CVE-2026-19666",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-19666",
          "title": "https://kb.isc.org/docs/cve-2026-19666"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:17.674132Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:27.902456Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:57.871881Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nOn a resolver configured to use ``dns64``, if an applicable answer from the authoritative server is malformed in a specific way, the resolver `named` process will exit unexpectedly.\nThis issue affects BIND 9 versions 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, 9.11.3-S1 through 9.18.50-S1, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-19666](https://kb.isc.org/docs/cve-2026-19666)\n",
      "epssDetails": {
        "percentile": "0.44692",
        "probability": "0.00569",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-19666"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:37.670794Z",
      "disclosureTime": "2026-09-16T15:17:33.520000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:37.674026Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-09-27T02:20:37.870447Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-BIND-20154259",
      "cpes": [],
      "title": "CVE-2026-77692",
      "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<9.20.29-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "9.20.29-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.5,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://downloads.isc.org/isc/bind9/9.20.29",
          "title": "https://downloads.isc.org/isc/bind9/9.20.29"
        },
        {
          "url": "https://downloads.isc.org/isc/bind9/9.21.26",
          "title": "https://downloads.isc.org/isc/bind9/9.21.26"
        },
        {
          "url": "https://kb.isc.org/docs/cve-2026-77692",
          "title": "https://kb.isc.org/docs/cve-2026-77692"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:02.443202Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T05:42:42.208528Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-23T11:01:59.405387Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `bind` package and not the `bind` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nAn attacker can cause `named` to abort by sending a crafted DNS-over-HTTPS request with a cryptographically invalid SIG(0) record, and then closing the transport connection prematurely.\nThis issue affects BIND 9 versions 9.20.0 through 9.20.27, 9.21.0 through 9.21.25, and 9.20.9-S1 through 9.20.27-S1.\n## Remediation\nUpgrade `Alpine:3.24` `bind` to version 9.20.29-r0 or higher.\n## References\n- [https://downloads.isc.org/isc/bind9/9.20.29](https://downloads.isc.org/isc/bind9/9.20.29)\n- [https://downloads.isc.org/isc/bind9/9.21.26](https://downloads.isc.org/isc/bind9/9.21.26)\n- [https://kb.isc.org/docs/cve-2026-77692](https://kb.isc.org/docs/cve-2026-77692)\n",
      "epssDetails": {
        "percentile": "0.93618",
        "probability": "0.06558",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-77692"
        ],
        "CWE": [],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "bind",
      "creationTime": "2026-09-27T02:20:47.914852Z",
      "disclosureTime": "2026-09-16T14:17:09.647000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-09-27T02:20:47.918189Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-05T14:04:23.816057Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-tools@9.20.27-r0"
      ],
      "upgradePath": [
        false,
        "bind/bind-tools@9.20.29-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "bind/bind-tools",
      "version": "9.20.27-r0",
      "nearestFixedInVersion": "9.20.29-r0"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [
        false,
        "zlib/zlib@1.3.2-r1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "apk-tools/apk-tools@3.0.8-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "gnutls/gnutls@3.8.13-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "mariadb-connector-c/mariadb-connector-c@3.4.6-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "apk-tools/apk-tools@3.0.8-r0",
        "apk-tools/libapk@3.0.8-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/coturn/coturn@4-alpine3.24",
        "bind/bind-libs@9.20.27-r0",
        "libxml2/libxml2@2.13.9-r2",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1",
      "dockerfileInstruction": "apk add --no-cache libevent libcrypto3 libssl3 libpq mariadb-connector-c sqlite-libs hiredis mongo-c-driver libmicrohttpd"
    }
  ],
  "ok": false,
  "dependencyCount": 57,
  "org": "sean.graham",
  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
  "isPrivate": true,
  "licensesPolicy": {
    "severities": {},
    "orgLicenseRules": {
      "AGPL-1.0": {
        "licenseType": "AGPL-1.0",
        "severity": "high",
        "instructions": ""
      },
      "AGPL-3.0": {
        "licenseType": "AGPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "Artistic-1.0": {
        "licenseType": "Artistic-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "Artistic-2.0": {
        "licenseType": "Artistic-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "CDDL-1.0": {
        "licenseType": "CDDL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "CPOL-1.02": {
        "licenseType": "CPOL-1.02",
        "severity": "high",
        "instructions": ""
      },
      "EPL-1.0": {
        "licenseType": "EPL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "GPL-2.0": {
        "licenseType": "GPL-2.0",
        "severity": "high",
        "instructions": ""
      },
      "GPL-3.0": {
        "licenseType": "GPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "LGPL-2.0": {
        "licenseType": "LGPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-2.1": {
        "licenseType": "LGPL-2.1",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-3.0": {
        "licenseType": "LGPL-3.0",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-1.1": {
        "licenseType": "MPL-1.1",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-2.0": {
        "licenseType": "MPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "MS-RL": {
        "licenseType": "MS-RL",
        "severity": "medium",
        "instructions": ""
      },
      "SimPL-2.0": {
        "licenseType": "SimPL-2.0",
        "severity": "high",
        "instructions": ""
      }
    }
  },
  "packageManager": "apk",
  "ignoreSettings": {
    "adminOnly": false,
    "reasonRequired": false,
    "disregardFilesystemIgnores": false,
    "autoApproveIgnores": false,
    "approvalWorkflowEnabled": false
  },
  "docker": {
    "os": {
      "prettyName": "Alpine Linux v3.24"
    }
  },
  "summary": "28 high or critical severity vulnerable dependency paths",
  "severityThreshold": "high",
  "filesystemPolicy": false,
  "filtered": {
    "ignore": [],
    "patch": []
  },
  "uniqueCount": 8,
  "projectName": "docker-image|docker.io/coturn/coturn",
  "platform": "linux/amd64",
  "hasUnknownVersions": false,
  "path": "docker.io/coturn/coturn:4-alpine3.24/coturn/coturn"
}