{
  "vulnerabilities": [
    {
      "id": "SNYK-ALPINE323-ZLIB-20541565",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T03:03:50.501449Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.23",
      "publicationTime": "2026-10-07T03:03:50.509150Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.003141Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/eclipse-mosquitto@2.0.22",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [
        false,
        "zlib/zlib@1.3.2-r1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1"
    },
    {
      "id": "SNYK-ALPINE323-ZLIB-20541565",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T03:03:50.501449Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.23",
      "publicationTime": "2026-10-07T03:03:50.509150Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.003141Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/eclipse-mosquitto@2.0.22",
        "apk-tools/apk-tools@3.0.8-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1"
    },
    {
      "id": "SNYK-ALPINE323-ZLIB-20541565",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.23` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.23` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T03:03:50.501449Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.23",
      "publicationTime": "2026-10-07T03:03:50.509150Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.003141Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/eclipse-mosquitto@2.0.22",
        "apk-tools/apk-tools@3.0.8-r0",
        "apk-tools/libapk@3.0.8-r0",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1"
    }
  ],
  "ok": false,
  "dependencyCount": 20,
  "org": "sean.graham",
  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
  "isPrivate": true,
  "licensesPolicy": {
    "severities": {},
    "orgLicenseRules": {
      "AGPL-1.0": {
        "licenseType": "AGPL-1.0",
        "severity": "high",
        "instructions": ""
      },
      "AGPL-3.0": {
        "licenseType": "AGPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "Artistic-1.0": {
        "licenseType": "Artistic-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "Artistic-2.0": {
        "licenseType": "Artistic-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "CDDL-1.0": {
        "licenseType": "CDDL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "CPOL-1.02": {
        "licenseType": "CPOL-1.02",
        "severity": "high",
        "instructions": ""
      },
      "EPL-1.0": {
        "licenseType": "EPL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "GPL-2.0": {
        "licenseType": "GPL-2.0",
        "severity": "high",
        "instructions": ""
      },
      "GPL-3.0": {
        "licenseType": "GPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "LGPL-2.0": {
        "licenseType": "LGPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-2.1": {
        "licenseType": "LGPL-2.1",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-3.0": {
        "licenseType": "LGPL-3.0",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-1.1": {
        "licenseType": "MPL-1.1",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-2.0": {
        "licenseType": "MPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "MS-RL": {
        "licenseType": "MS-RL",
        "severity": "medium",
        "instructions": ""
      },
      "SimPL-2.0": {
        "licenseType": "SimPL-2.0",
        "severity": "high",
        "instructions": ""
      }
    }
  },
  "packageManager": "apk",
  "ignoreSettings": {
    "adminOnly": false,
    "reasonRequired": false,
    "disregardFilesystemIgnores": false,
    "autoApproveIgnores": false,
    "approvalWorkflowEnabled": false
  },
  "docker": {
    "os": {
      "prettyName": "Alpine Linux v3.23"
    }
  },
  "summary": "3 high or critical severity vulnerable dependency paths",
  "severityThreshold": "high",
  "filesystemPolicy": false,
  "filtered": {
    "ignore": [],
    "patch": []
  },
  "uniqueCount": 1,
  "projectName": "docker-image|docker.io/eclipse-mosquitto",
  "platform": "linux/amd64",
  "hasUnknownVersions": false,
  "path": "docker.io/eclipse-mosquitto:2.0.22/eclipse-mosquitto"
}