{ "vulnerabilities": [ { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "coreutils@9.7-3", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "sed@4.9-2+deb13u1", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "shadow/passwd@1:4.17.4-2", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ACL-17677866", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54369", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54369" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1", "title": "https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1" }, { "url": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions", "title": "https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34351", "title": "https://access.redhat.com/errata/RHSA-2026:34351" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42736", "title": "https://access.redhat.com/errata/RHSA-2026:42736" }, { "url": "https://access.redhat.com/errata/RHSA-2026:42739", "title": "https://access.redhat.com/errata/RHSA-2026:42739" }, { "url": "https://access.redhat.com/errata/RHSA-2026:43420", "title": "https://access.redhat.com/errata/RHSA-2026:43420" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54369", "title": "https://access.redhat.com/security/cve/CVE-2026-54369" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:44481", "title": "https://access.redhat.com/errata/RHSA-2026:44481" }, { "url": "https://access.redhat.com/errata/RHSA-2026:46836", "title": "https://access.redhat.com/errata/RHSA-2026:46836" }, { "url": "https://access.redhat.com/errata/RHSA-2026:50205", "title": "https://access.redhat.com/errata/RHSA-2026:50205" }, { "url": "https://access.redhat.com/errata/RHSA-2026:53371", "title": "https://access.redhat.com/errata/RHSA-2026:53371" }, { "url": "https://access.redhat.com/errata/RHSA-2026:54769", "title": "https://access.redhat.com/errata/RHSA-2026:54769" }, { "url": "https://access.redhat.com/errata/RHSA-2026:58981", "title": "https://access.redhat.com/errata/RHSA-2026:58981" }, { "url": "https://access.redhat.com/errata/RHSA-2026:64805", "title": "https://access.redhat.com/errata/RHSA-2026:64805" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67140", "title": "https://access.redhat.com/errata/RHSA-2026:67140" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67142", "title": "https://access.redhat.com/errata/RHSA-2026:67142" }, { "url": "https://access.redhat.com/errata/RHSA-2026:67144", "title": "https://access.redhat.com/errata/RHSA-2026:67144" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:55.003046Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T07:07:59.950283Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:35.978130Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `acl` package and not the `acl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nacl before version 2.4.0 contains a symlink traversal vulnerability in the libacl pathname-based functions acl_get_file(), acl_set_file(), acl_extended_file(), and acl_delete_def_file() that allows local attackers to escalate privileges by replacing any pathname component with a symbolic link. Attackers who control any component of a pathname processed by a privileged caller can redirect ACL read or write operations to arbitrary files or directories, enabling unauthorized manipulation of access control lists and local privilege escalation.\n## Remediation\nThere is no fixed version for `Debian:13` `acl`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54369](https://security-tracker.debian.org/tracker/CVE-2026-54369)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=24a227d0ab8576612194f8a56c2314389adc74a5)\n- [https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1](https://cgit.git.savannah.nongnu.org/cgit/acl.git/commit/?id=3589787cd589b34bdd9265936e17190b6d3f17d1)\n- [https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions](https://www.vulncheck.com/advisories/acl-symlink-traversal-privilege-escalation-via-libacl-functions)\n- [https://access.redhat.com/errata/RHSA-2026:34351](https://access.redhat.com/errata/RHSA-2026:34351)\n- [https://access.redhat.com/errata/RHSA-2026:42736](https://access.redhat.com/errata/RHSA-2026:42736)\n- [https://access.redhat.com/errata/RHSA-2026:42739](https://access.redhat.com/errata/RHSA-2026:42739)\n- [https://access.redhat.com/errata/RHSA-2026:43420](https://access.redhat.com/errata/RHSA-2026:43420)\n- [https://access.redhat.com/security/cve/CVE-2026-54369](https://access.redhat.com/security/cve/CVE-2026-54369)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490277](https://bugzilla.redhat.com/show_bug.cgi?id=2490277)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54369.json)\n- [https://access.redhat.com/errata/RHSA-2026:44481](https://access.redhat.com/errata/RHSA-2026:44481)\n- [https://access.redhat.com/errata/RHSA-2026:46836](https://access.redhat.com/errata/RHSA-2026:46836)\n- [https://access.redhat.com/errata/RHSA-2026:50205](https://access.redhat.com/errata/RHSA-2026:50205)\n- [https://access.redhat.com/errata/RHSA-2026:53371](https://access.redhat.com/errata/RHSA-2026:53371)\n- [https://access.redhat.com/errata/RHSA-2026:54769](https://access.redhat.com/errata/RHSA-2026:54769)\n- [https://access.redhat.com/errata/RHSA-2026:58981](https://access.redhat.com/errata/RHSA-2026:58981)\n- [https://access.redhat.com/errata/RHSA-2026:64805](https://access.redhat.com/errata/RHSA-2026:64805)\n- [https://access.redhat.com/errata/RHSA-2026:67140](https://access.redhat.com/errata/RHSA-2026:67140)\n- [https://access.redhat.com/errata/RHSA-2026:67142](https://access.redhat.com/errata/RHSA-2026:67142)\n- [https://access.redhat.com/errata/RHSA-2026:67144](https://access.redhat.com/errata/RHSA-2026:67144)\n", "epssDetails": { "percentile": "0.03798", "probability": "0.00153", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54369" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "acl", "creationTime": "2026-06-30T00:27:10.988309Z", "disclosureTime": "2026-06-29T14:16:57.487000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:27:10.995039Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-30T14:05:13.338489Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "dpkg@1.22.22", "tar@1.35+dfsg-3.1", "acl/libacl1@2.3.2-2+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "acl/libacl1", "version": "2.3.2-2+b1" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "coreutils@9.7-3", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-ATTR-17678182", "cpes": [], "title": "Link Following", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-54371", "title": "https://security-tracker.debian.org/tracker/CVE-2026-54371" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f" }, { "url": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b", "title": "https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b" }, { "url": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr", "title": "https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-54371", "title": "https://access.redhat.com/security/cve/CVE-2026-54371" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2490283" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json" }, { "url": "https://access.redhat.com/errata/RHSA-2026:34889", "title": "https://access.redhat.com/errata/RHSA-2026:34889" }, { "url": "https://access.redhat.com/errata/RHSA-2026:56133", "title": "https://access.redhat.com/errata/RHSA-2026:56133" }, { "url": "https://access.redhat.com/errata/RHSA-2026:59380", "title": "https://access.redhat.com/errata/RHSA-2026:59380" }, { "url": "https://access.redhat.com/errata/RHSA-2026:60226", "title": "https://access.redhat.com/errata/RHSA-2026:60226" }, { "url": "https://access.redhat.com/errata/RHSA-2026:61783", "title": "https://access.redhat.com/errata/RHSA-2026:61783" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63135", "title": "https://access.redhat.com/errata/RHSA-2026:63135" }, { "url": "https://access.redhat.com/errata/RHSA-2026:63138", "title": "https://access.redhat.com/errata/RHSA-2026:63138" }, { "url": "https://access.redhat.com/errata/RHSA-2026:66018", "title": "https://access.redhat.com/errata/RHSA-2026:66018" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 7.1, "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 6.3, "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.1, "cvssVersion": "3.1", "modificationTime": "2026-06-30T01:28:53.584255Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.3, "cvssVersion": "3.1", "modificationTime": "2026-07-03T06:26:07.726913Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-16T11:03:47.219902Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `attr` package and not the `attr` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nattr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path.\n## Remediation\nThere is no fixed version for `Debian:13` `attr`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-54371](https://security-tracker.debian.org/tracker/CVE-2026-54371)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f)\n- [https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b](https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b)\n- [https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr](https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr)\n- [https://access.redhat.com/security/cve/CVE-2026-54371](https://access.redhat.com/security/cve/CVE-2026-54371)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2490283](https://bugzilla.redhat.com/show_bug.cgi?id=2490283)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json)\n- [https://access.redhat.com/errata/RHSA-2026:34889](https://access.redhat.com/errata/RHSA-2026:34889)\n- [https://access.redhat.com/errata/RHSA-2026:56133](https://access.redhat.com/errata/RHSA-2026:56133)\n- [https://access.redhat.com/errata/RHSA-2026:59380](https://access.redhat.com/errata/RHSA-2026:59380)\n- [https://access.redhat.com/errata/RHSA-2026:60226](https://access.redhat.com/errata/RHSA-2026:60226)\n- [https://access.redhat.com/errata/RHSA-2026:61783](https://access.redhat.com/errata/RHSA-2026:61783)\n- [https://access.redhat.com/errata/RHSA-2026:63135](https://access.redhat.com/errata/RHSA-2026:63135)\n- [https://access.redhat.com/errata/RHSA-2026:63138](https://access.redhat.com/errata/RHSA-2026:63138)\n- [https://access.redhat.com/errata/RHSA-2026:66018](https://access.redhat.com/errata/RHSA-2026:66018)\n", "epssDetails": { "percentile": "0.03325", "probability": "0.00146", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-54371" ], "CWE": [ "CWE-59" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "attr", "creationTime": "2026-06-30T00:33:09.679328Z", "disclosureTime": "2026-06-29T14:16:57.823000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T00:33:09.682988Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-09T17:00:56.896952Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "shadow/passwd@1:4.17.4-2", "attr/libattr1@1:2.5.2-3" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "attr/libattr1", "version": "1:2.5.2-3" }, { "id": "SNYK-DEBIAN13-GZIP-17681798", "cpes": [], "title": "Buffer Over-read", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<1.13-1+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "1.13-1+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-41992", "title": "https://security-tracker.debian.org/tracker/CVE-2026-41992" }, { "url": "https://cert.pl/en/posts/2026/04/CVE-2026-41991/", "title": "https://cert.pl/en/posts/2026/04/CVE-2026-41991/" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681", "title": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681" }, { "url": "https://www.gnu.org/software/gzip/", "title": "https://www.gnu.org/software/gzip/" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/23/1", "title": "http://www.openwall.com/lists/oss-security/2026/08/23/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/25/1", "title": "http://www.openwall.com/lists/oss-security/2026/08/25/1" }, { "url": "http://www.openwall.com/lists/oss-security/2026/08/27/2", "title": "http://www.openwall.com/lists/oss-security/2026/08/27/2" }, { "url": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d", "title": "https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-08-24T01:29:36.282455Z" }, { "assigner": "Red Hat", "severity": "low", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "cvssV3BaseScore": 3.6, "modificationTime": "2026-09-01T05:36:58.376035Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "cvssV3BaseScore": 6.1, "modificationTime": "2026-08-13T11:02:55.737017Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-08-24T01:29:36.282455Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:L", "assigner": "Red Hat", "severity": "low", "baseScore": 3.6, "cvssVersion": "3.1", "modificationTime": "2026-09-01T05:36:58.376035Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 6.1, "cvssVersion": "3.1", "modificationTime": "2026-08-13T11:02:55.737017Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `gzip` package and not the `gzip` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nGNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d.\n## Remediation\nUpgrade `Debian:13` `gzip` to version 1.13-1+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-41992](https://security-tracker.debian.org/tracker/CVE-2026-41992)\n- [https://cert.pl/en/posts/2026/04/CVE-2026-41991/](https://cert.pl/en/posts/2026/04/CVE-2026-41991/)\n- [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681](https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681)\n- [https://www.gnu.org/software/gzip/](https://www.gnu.org/software/gzip/)\n- [http://www.openwall.com/lists/oss-security/2026/08/23/1](http://www.openwall.com/lists/oss-security/2026/08/23/1)\n- [http://www.openwall.com/lists/oss-security/2026/08/25/1](http://www.openwall.com/lists/oss-security/2026/08/25/1)\n- [http://www.openwall.com/lists/oss-security/2026/08/27/2](http://www.openwall.com/lists/oss-security/2026/08/27/2)\n- [https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d](https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d)\n", "epssDetails": { "percentile": "0.48461", "probability": "0.00620", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-41992" ], "CWE": [ "CWE-126" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "gzip", "creationTime": "2026-06-30T01:46:52.922304Z", "disclosureTime": "2026-06-29T12:16:29.940000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-30T01:46:52.924679Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-14T14:49:08.759465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "gzip@1.13-1" ], "upgradePath": [ false, "gzip@1.13-1+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "gzip", "version": "1.13-1", "nearestFixedInVersion": "1.13-1+deb13u1" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [ false, "pcre2/libpcre2-8-0@10.46-1~deb13u2" ], "isUpgradable": true, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [ false, "pcre2/libpcre2-8-0@10.46-1~deb13u2" ], "isUpgradable": true, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "grep@3.11-4", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "grep@3.11-4", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685515", "cpes": [], "title": "Free of Memory not on the Heap", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89161", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89161" }, { "url": "https://github.com/PCRE2Project/pcre2/pull/937", "title": "https://github.com/PCRE2Project/pcre2/pull/937" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "cvssV3BaseScore": 7.5, "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:42.876297Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:51.962108Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:26.133426Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89161](https://security-tracker.debian.org/tracker/CVE-2026-89161)\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n", "epssDetails": { "percentile": "0.01943", "probability": "0.00126", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89161" ], "CWE": [ "CWE-590" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:20.037738Z", "disclosureTime": "2026-09-11T04:18:04.470000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:20.044015Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.660988Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "apt@3.0.3", "base-passwd@3.6.7", "libselinux/libselinux1@3.8.1-1", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PCRE2-19685522", "cpes": [], "title": "Integer Overflow or Wraparound", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<10.46-1~deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "10.46-1~deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-89157", "title": "https://security-tracker.debian.org/tracker/CVE-2026-89157" }, { "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48", "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48" }, { "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9", "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "cvssV3BaseScore": 5.7, "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.1, "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-17T01:30:43.018395Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-09-12T06:07:46.857038Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 8.1, "cvssVersion": "3.1", "modificationTime": "2026-09-18T11:06:09.698583Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Debian:13` `pcre2` to version 10.46-1~deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-89157](https://security-tracker.debian.org/tracker/CVE-2026-89157)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n", "epssDetails": { "percentile": "0.18076", "probability": "0.00278", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-89157" ], "CWE": [ "CWE-190" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "pcre2", "creationTime": "2026-09-11T15:34:24.796009Z", "disclosureTime": "2026-09-11T04:18:03.753000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-11T15:34:24.800041Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-25T21:46:05.406749Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "apt@3.0.3", "base-passwd@3.6.7", "libselinux/libselinux1@3.8.1-1", "pcre2/libpcre2-8-0@10.46-1~deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "pcre2/libpcre2-8-0", "version": "10.46-1~deb13u1", "nearestFixedInVersion": "10.46-1~deb13u2" }, { "id": "SNYK-DEBIAN13-PERL-16896261", "cpes": [], "title": "CVE-2026-8376", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-8376", "title": "https://security-tracker.debian.org/tracker/CVE-2026-8376" }, { "url": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch", "title": "https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch" }, { "url": "http://www.openwall.com/lists/oss-security/2026/05/26/1", "title": "http://www.openwall.com/lists/oss-security/2026/05/26/1" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 9.8, "modificationTime": "2026-05-28T01:14:54.805456Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvssV3BaseScore": 5.7, "modificationTime": "2026-07-02T07:47:08.536732Z" }, { "assigner": "SUSE", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "cvssV3BaseScore": 5.7, "modificationTime": "2026-07-28T11:06:58.531635Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.8, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:54.805456Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-07-02T07:47:08.536732Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "assigner": "SUSE", "severity": "medium", "baseScore": 5.7, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:06:58.531635Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-8376](https://security-tracker.debian.org/tracker/CVE-2026-8376)\n- [https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch](https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch)\n- [http://www.openwall.com/lists/oss-security/2026/05/26/1](http://www.openwall.com/lists/oss-security/2026/05/26/1)\n", "epssDetails": { "percentile": "0.38801", "probability": "0.00481", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-8376" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-05-27T18:27:19.013975Z", "disclosureTime": "2026-05-26T00:16:57.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-27T18:27:19.018190Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:22:36.162994Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17037371", "cpes": [], "title": "CVE-2026-42497", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.5, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42497", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42497" }, { "url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch" }, { "url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42496", "title": "https://www.cve.org/CVERecord?id=CVE-2026-42496" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-05-28T01:14:58.033365Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "cvssV3BaseScore": 6.8, "modificationTime": "2026-06-18T05:36:36.076537Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "NVD", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:58.033365Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:H/A:H", "assigner": "Red Hat", "severity": "medium", "baseScore": 6.8, "cvssVersion": "3.1", "modificationTime": "2026-06-18T05:36:36.076537Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42497](https://security-tracker.debian.org/tracker/CVE-2026-42497)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42496](https://www.cve.org/CVERecord?id=CVE-2026-42496)\n", "epssDetails": { "percentile": "0.38002", "probability": "0.00471", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42497" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "perl", "creationTime": "2026-05-29T03:54:32.389334Z", "disclosureTime": "2026-05-26T02:16:40.250000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-29T03:54:32.395259Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-24T14:15:05.396422Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17037434", "cpes": [], "title": "CVE-2026-42496", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-42496", "title": "https://security-tracker.debian.org/tracker/CVE-2026-42496" }, { "url": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch", "title": "https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch" }, { "url": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes", "title": "https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes" }, { "url": "https://www.cve.org/CVERecord?id=CVE-2026-42497", "title": "https://www.cve.org/CVERecord?id=CVE-2026-42497" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30851", "title": "https://access.redhat.com/errata/RHSA-2026:30851" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30852", "title": "https://access.redhat.com/errata/RHSA-2026:30852" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30856", "title": "https://access.redhat.com/errata/RHSA-2026:30856" }, { "url": "https://access.redhat.com/errata/RHSA-2026:30857", "title": "https://access.redhat.com/errata/RHSA-2026:30857" }, { "url": "https://access.redhat.com/security/cve/CVE-2026-42496", "title": "https://access.redhat.com/security/cve/CVE-2026-42496" }, { "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314", "title": "https://bugzilla.redhat.com/show_bug.cgi?id=2481314" }, { "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json", "title": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "cvssV3BaseScore": 9.1, "modificationTime": "2026-05-28T01:14:55.022369Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "cvssV3BaseScore": 8.2, "modificationTime": "2026-06-03T14:06:17.624574Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-05-28T01:14:55.022369Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 8.2, "cvssVersion": "3.1", "modificationTime": "2026-06-03T14:06:17.624574Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nArchive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-42496](https://security-tracker.debian.org/tracker/CVE-2026-42496)\n- [https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch](https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch)\n- [https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes](https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes)\n- [https://www.cve.org/CVERecord?id=CVE-2026-42497](https://www.cve.org/CVERecord?id=CVE-2026-42497)\n- [https://access.redhat.com/errata/RHSA-2026:30851](https://access.redhat.com/errata/RHSA-2026:30851)\n- [https://access.redhat.com/errata/RHSA-2026:30852](https://access.redhat.com/errata/RHSA-2026:30852)\n- [https://access.redhat.com/errata/RHSA-2026:30856](https://access.redhat.com/errata/RHSA-2026:30856)\n- [https://access.redhat.com/errata/RHSA-2026:30857](https://access.redhat.com/errata/RHSA-2026:30857)\n- [https://access.redhat.com/security/cve/CVE-2026-42496](https://access.redhat.com/security/cve/CVE-2026-42496)\n- [https://bugzilla.redhat.com/show_bug.cgi?id=2481314](https://bugzilla.redhat.com/show_bug.cgi?id=2481314)\n- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json)\n", "epssDetails": { "percentile": "0.34984", "probability": "0.00430", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-42496" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-05-29T04:11:54.743735Z", "disclosureTime": "2026-05-26T02:16:40.130000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-05-29T04:11:54.747530Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:04:14.820656Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17960057", "cpes": [], "title": "CVE-2026-13221", "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "critical", "cvssScore": 9.1, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-13221", "title": "https://security-tracker.debian.org/tracker/CVE-2026-13221" }, { "url": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch", "title": "https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch" }, { "url": "https://github.com/Perl/perl5/issues/23388", "title": "https://github.com/Perl/perl5/issues/23388" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/13/5", "title": "http://www.openwall.com/lists/oss-security/2026/07/13/5" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "critical", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 9.1, "modificationTime": "2026-09-09T01:20:11.955037Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "cvssV3BaseScore": 5.9, "modificationTime": "2026-08-19T05:43:37.782483Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:01.362674Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "critical", "baseScore": 9.1, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:20:11.955037Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5.9, "cvssVersion": "3.1", "modificationTime": "2026-08-19T05:43:37.782483Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:01.362674Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-13221](https://security-tracker.debian.org/tracker/CVE-2026-13221)\n- [https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch](https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch)\n- [https://github.com/Perl/perl5/issues/23388](https://github.com/Perl/perl5/issues/23388)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/5](http://www.openwall.com/lists/oss-security/2026/07/13/5)\n", "epssDetails": { "percentile": "0.35340", "probability": "0.00432", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-13221" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "critical", "packageName": "perl", "creationTime": "2026-07-14T05:03:12.495412Z", "disclosureTime": "2026-07-13T17:16:48.923000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-14T05:03:12.500368Z", "severityBasedOn": "CVSS", "modificationTime": "2026-09-12T15:21:41.336025Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "critical", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-PERL-17960058", "cpes": [], "title": "CVE-2026-57432", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<5.40.1-6+deb13u1" ] }, "exploit": "Not Defined", "fixedIn": [ "5.40.1-6+deb13u1" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 8.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-57432", "title": "https://security-tracker.debian.org/tracker/CVE-2026-57432" }, { "url": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch", "title": "https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch" }, { "url": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch", "title": "https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch" }, { "url": "http://www.openwall.com/lists/oss-security/2026/07/13/6", "title": "http://www.openwall.com/lists/oss-security/2026/07/13/6" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 8.4, "modificationTime": "2026-09-09T01:20:11.773900Z" }, { "assigner": "Red Hat", "severity": "medium", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 5, "modificationTime": "2026-08-04T05:26:17.222570Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "cvssV3BaseScore": 7.5, "modificationTime": "2026-07-28T11:07:15.786140Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 8.4, "cvssVersion": "3.1", "modificationTime": "2026-09-09T01:20:11.773900Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "assigner": "Red Hat", "severity": "medium", "baseScore": 5, "cvssVersion": "3.1", "modificationTime": "2026-08-04T05:26:17.222570Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "assigner": "SUSE", "severity": "high", "baseScore": 7.5, "cvssVersion": "3.1", "modificationTime": "2026-07-28T11:07:15.786140Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `perl` package and not the `perl` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nPerl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller.\n## Remediation\nUpgrade `Debian:13` `perl` to version 5.40.1-6+deb13u1 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-57432](https://security-tracker.debian.org/tracker/CVE-2026-57432)\n- [https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch](https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch)\n- [https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch](https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch)\n- [http://www.openwall.com/lists/oss-security/2026/07/13/6](http://www.openwall.com/lists/oss-security/2026/07/13/6)\n", "epssDetails": { "percentile": "0.10283", "probability": "0.00211", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-57432" ], "CWE": [], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "perl", "creationTime": "2026-07-14T05:03:48.770266Z", "disclosureTime": "2026-07-13T17:17:55.670000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-07-14T05:03:48.773232Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-02T14:02:48.233225Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "perl/perl-base@5.40.1-6" ], "upgradePath": [ false, "perl/perl-base@5.40.1-6+deb13u1" ], "isUpgradable": true, "isPatchable": false, "name": "perl/perl-base", "version": "5.40.1-6", "nearestFixedInVersion": "5.40.1-6+deb13u1" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334397", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11822", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11822" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension", "title": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension](https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.20341", "probability": "0.00295", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11822" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:49:26.750605Z", "disclosureTime": "2026-06-09T20:16:32.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:49:26.756974Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:54.647480Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [ false, "sqlite3/libsqlite3-0@3.46.1-7+deb13u2" ], "isUpgradable": true, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334400", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11824", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11824" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate", "title": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate](https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.06581", "probability": "0.00176", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11824" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:50:32.196166Z", "disclosureTime": "2026-06-09T20:16:32.300000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:50:32.199279Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:43.795465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [ false, "sqlite3/libsqlite3-0@3.46.1-7+deb13u2" ], "isUpgradable": true, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334397", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11822", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11822" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension", "title": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.544883Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:08:27.224821Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:51.303060Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process crashes, memory exhaustion, or arbitrary code execution by supplying a crafted database with malformed FTS5 page data. Attackers can trigger an out-of-bounds read in fts5LeafSeek() via an attacker-controlled loop bound and a heap buffer overflow write in fts5ChunkIterate() through a crafted continuation page causing an integer underflow, exploitable when an FTS5 MATCH query is executed against the malicious database.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11822](https://security-tracker.debian.org/tracker/CVE-2026-11822)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension](https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.20341", "probability": "0.00295", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11822" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:49:26.750605Z", "disclosureTime": "2026-06-09T20:16:32.150000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:49:26.756974Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:54.647480Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "util-linux/liblastlog2-2@2.41-5", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-SQLITE3-17334400", "cpes": [], "title": "Heap-based Buffer Overflow", "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "<3.46.1-7+deb13u2" ] }, "exploit": "Not Defined", "fixedIn": [ "3.46.1-7+deb13u2" ], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.8, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-11824", "title": "https://security-tracker.debian.org/tracker/CVE-2026-11824" }, { "url": "https://sqlite.org/releaselog/3_53_2.html", "title": "https://sqlite.org/releaselog/3_53_2.html" }, { "url": "https://sqlite.org/src/info/061febcf41ca", "title": "https://sqlite.org/src/info/061febcf41ca" }, { "url": "https://sqlite.org/src/info/4a5ad516ea93", "title": "https://sqlite.org/src/info/4a5ad516ea93" }, { "url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate", "title": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate" }, { "url": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html", "title": "https://cert-portal.siemens.com/productcert/html/ssa-765416.html" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "assigner": "Red Hat", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "assigner": "SUSE", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "cvssV3BaseScore": 7.8, "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-10T01:21:19.707164Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "Red Hat", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-08-26T06:09:03.239253Z" }, { "type": "secondary", "vector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "assigner": "SUSE", "severity": "high", "baseScore": 7.8, "cvssVersion": "3.1", "modificationTime": "2026-06-24T11:09:56.278893Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `sqlite3` package and not the `sqlite3` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nSQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malicious continuation page metadata specifying a szLeaf value smaller than 4. Attackers can trigger an integer underflow in fts5ChunkIterate() causing an inflated remaining byte count during FTS5 MATCH query processing, leading to a heap buffer overflow of attacker-controlled data in applications compiled with SQLITE_ENABLE_FTS5.\n## Remediation\nUpgrade `Debian:13` `sqlite3` to version 3.46.1-7+deb13u2 or higher.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-11824](https://security-tracker.debian.org/tracker/CVE-2026-11824)\n- [https://sqlite.org/releaselog/3_53_2.html](https://sqlite.org/releaselog/3_53_2.html)\n- [https://sqlite.org/src/info/061febcf41ca](https://sqlite.org/src/info/061febcf41ca)\n- [https://sqlite.org/src/info/4a5ad516ea93](https://sqlite.org/src/info/4a5ad516ea93)\n- [https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate](https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate)\n- [https://cert-portal.siemens.com/productcert/html/ssa-765416.html](https://cert-portal.siemens.com/productcert/html/ssa-765416.html)\n", "epssDetails": { "percentile": "0.06581", "probability": "0.00176", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-11824" ], "CWE": [ "CWE-122" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "sqlite3", "creationTime": "2026-06-14T04:50:32.196166Z", "disclosureTime": "2026-06-09T20:16:32.300000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-06-14T04:50:32.199279Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-15T13:18:43.795465Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "util-linux/liblastlog2-2@2.41-5", "sqlite3/libsqlite3-0@3.46.1-7+deb13u1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "sqlite3/libsqlite3-0", "version": "3.46.1-7+deb13u1", "nearestFixedInVersion": "3.46.1-7+deb13u2" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "dpkg@1.22.22", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends ca-certificates tzdata libunwind8 $PACKAGES" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "apt@3.0.3", "apt/libapt-pkg7.0@3.0.3", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends ca-certificates tzdata libunwind8 $PACKAGES" }, { "id": "SNYK-DEBIAN13-ZLIB-19520500", "cpes": [], "title": "Out-of-bounds Write", "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "credit": [ "" ], "semver": { "vulnerable": [ "*" ] }, "exploit": "Not Defined", "fixedIn": [], "patches": [], "insights": { "triageAdvice": null }, "language": "linux", "severity": "high", "cvssScore": 7.4, "malicious": false, "isDisputed": false, "references": [ { "url": "https://security-tracker.debian.org/tracker/CVE-2026-85091", "title": "https://security-tracker.debian.org/tracker/CVE-2026-85091" }, { "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490", "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490" }, { "url": "https://github.com/madler/zlib", "title": "https://github.com/madler/zlib" }, { "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393", "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393" }, { "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate", "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate" } ], "cvssDetails": [ { "assigner": "NVD", "severity": "high", "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "cvssV3BaseScore": 7.4, "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "cvssSources": [ { "type": "primary", "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "assigner": "NVD", "severity": "high", "baseScore": 7.4, "cvssVersion": "3.1", "modificationTime": "2026-09-04T01:29:18.339972Z" } ], "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Debian`._\n_See `How to fix?` for `Debian:13` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nThere is no fixed version for `Debian:13` `zlib`.\n## References\n- [https://security-tracker.debian.org/tracker/CVE-2026-85091](https://security-tracker.debian.org/tracker/CVE-2026-85091)\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n", "epssDetails": { "percentile": "0.27225", "probability": "0.00356", "modelVersion": "v2026.06.15" }, "identifiers": { "CVE": [ "CVE-2026-85091" ], "CWE": [ "CWE-787" ], "ALTERNATIVE": [] }, "nvdSeverity": "high", "packageName": "zlib", "creationTime": "2026-09-04T04:43:41.644434Z", "disclosureTime": "2026-09-03T13:06:20.573000Z", "exploitDetails": { "sources": [], "maturityLevels": [ { "type": "secondary", "level": "Not Defined", "format": "CVSSv3" }, { "type": "primary", "level": "Not Defined", "format": "CVSSv4" } ] }, "packageManager": "debian:13", "publicationTime": "2026-09-04T04:43:41.651764Z", "severityBasedOn": "CVSS", "modificationTime": "2026-10-08T15:12:01.975922Z", "socialTrendAlert": false, "relativeImportance": "not yet assigned", "severityWithCritical": "high", "from": [ "docker-image|docker.io/qdrant/qdrant@v1.18.3", "ca-certificates@20250419", "openssl@3.5.6-1~deb13u2", "openssl/libssl3t64@3.5.6-1~deb13u2", "zlib/zlib1g@1:1.3.dfsg+really1.3.1-1+b1" ], "upgradePath": [], "isUpgradable": false, "isPatchable": false, "name": "zlib/zlib1g", "version": "1:1.3.dfsg+really1.3.1-1+b1", "dockerfileInstruction": "apt-get install -y --no-install-recommends ca-certificates tzdata libunwind8 $PACKAGES" } ], "ok": false, "dependencyCount": 81, "org": "sean.graham", "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n", "isPrivate": true, "licensesPolicy": { "severities": {}, "orgLicenseRules": { "AGPL-1.0": { "licenseType": "AGPL-1.0", "severity": "high", "instructions": "" }, "AGPL-3.0": { "licenseType": "AGPL-3.0", "severity": "high", "instructions": "" }, "Artistic-1.0": { "licenseType": "Artistic-1.0", "severity": "medium", "instructions": "" }, "Artistic-2.0": { "licenseType": "Artistic-2.0", "severity": "medium", "instructions": "" }, "CDDL-1.0": { "licenseType": "CDDL-1.0", "severity": "medium", "instructions": "" }, "CPOL-1.02": { "licenseType": "CPOL-1.02", "severity": "high", "instructions": "" }, "EPL-1.0": { "licenseType": "EPL-1.0", "severity": "medium", "instructions": "" }, "GPL-2.0": { "licenseType": "GPL-2.0", "severity": "high", "instructions": "" }, "GPL-3.0": { "licenseType": "GPL-3.0", "severity": "high", "instructions": "" }, "LGPL-2.0": { "licenseType": "LGPL-2.0", "severity": "medium", "instructions": "" }, "LGPL-2.1": { "licenseType": "LGPL-2.1", "severity": "medium", "instructions": "" }, "LGPL-3.0": { "licenseType": "LGPL-3.0", "severity": "medium", "instructions": "" }, "MPL-1.1": { "licenseType": "MPL-1.1", "severity": "medium", "instructions": "" }, "MPL-2.0": { "licenseType": "MPL-2.0", "severity": "medium", "instructions": "" }, "MS-RL": { "licenseType": "MS-RL", "severity": "medium", "instructions": "" }, "SimPL-2.0": { "licenseType": "SimPL-2.0", "severity": "high", "instructions": "" } } }, "packageManager": "deb", "ignoreSettings": { "adminOnly": false, "reasonRequired": false, "disregardFilesystemIgnores": false, "autoApproveIgnores": false, "approvalWorkflowEnabled": false }, "docker": { "os": { "prettyName": "Debian GNU/Linux 13 (trixie)" } }, "summary": "27 high or critical severity vulnerable dependency paths", "severityThreshold": "high", "filesystemPolicy": false, "filtered": { "ignore": [], "patch": [] }, "uniqueCount": 13, "projectName": "docker-image|docker.io/qdrant/qdrant", "platform": "linux/amd64", "hasUnknownVersions": false, "path": "docker.io/qdrant/qdrant:v1.18.3/qdrant/qdrant" }