{
  "vulnerabilities": [
    {
      "id": "SNYK-ALPINE324-PCRE2-20364478",
      "cpes": [],
      "title": "Integer Overflow or Wraparound",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<10.48-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "10.48-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
          "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-17T01:30:43.018395Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "cvssV3BaseScore": 5.7,
          "modificationTime": "2026-09-12T06:07:46.857038Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2026-09-18T11:06:09.698583Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:43.018395Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "assigner": "Red Hat",
          "severity": "medium",
          "baseScore": 5.7,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-12T06:07:46.857038Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 8.1,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-18T11:06:09.698583Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Alpine:3.24` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n",
      "epssDetails": {
        "percentile": "0.18076",
        "probability": "0.00278",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-89157"
        ],
        "CWE": [
          "CWE-190"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "pcre2",
      "creationTime": "2026-10-01T14:20:42.837132Z",
      "disclosureTime": "2026-09-11T04:18:03.753000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-01T14:20:42.840513Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-01T14:20:42.894796Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "pcre2/pcre2@10.47-r1"
      ],
      "upgradePath": [
        false,
        "pcre2/pcre2@10.48-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "pcre2/pcre2",
      "version": "10.47-r1",
      "nearestFixedInVersion": "10.48-r0"
    },
    {
      "id": "SNYK-ALPINE324-PCRE2-20364480",
      "cpes": [],
      "title": "Free of Memory not on the Heap",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<10.48-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "10.48-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.8,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://github.com/PCRE2Project/pcre2/pull/937",
          "title": "https://github.com/PCRE2Project/pcre2/pull/937"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2026-09-17T01:30:42.876297Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-12T06:07:51.962108Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-18T11:06:26.133426Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.8,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:42.876297Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-12T06:07:51.962108Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-18T11:06:26.133426Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Alpine:3.24` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n",
      "epssDetails": {
        "percentile": "0.01943",
        "probability": "0.00126",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-89161"
        ],
        "CWE": [
          "CWE-590"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "pcre2",
      "creationTime": "2026-10-01T14:20:51.276784Z",
      "disclosureTime": "2026-09-11T04:18:04.470000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-01T14:20:51.279254Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-01T14:20:51.351108Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "pcre2/pcre2@10.47-r1"
      ],
      "upgradePath": [
        false,
        "pcre2/pcre2@10.48-r0"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "pcre2/pcre2",
      "version": "10.47-r1",
      "nearestFixedInVersion": "10.48-r0"
    },
    {
      "id": "SNYK-ALPINE324-PCRE2-20364478",
      "cpes": [],
      "title": "Integer Overflow or Wraparound",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<10.48-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "10.48-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9",
          "title": "https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-17T01:30:43.018395Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "medium",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "cvssV3BaseScore": 5.7,
          "modificationTime": "2026-09-12T06:07:46.857038Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 8.1,
          "modificationTime": "2026-09-18T11:06:09.698583Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:43.018395Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
          "assigner": "Red Hat",
          "severity": "medium",
          "baseScore": 5.7,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-12T06:07:46.857038Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 8.1,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-18T11:06:09.698583Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nPCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern.\n## Remediation\nUpgrade `Alpine:3.24` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n- [https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9](https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9)\n",
      "epssDetails": {
        "percentile": "0.18076",
        "probability": "0.00278",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-89157"
        ],
        "CWE": [
          "CWE-190"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "pcre2",
      "creationTime": "2026-10-01T14:20:42.837132Z",
      "disclosureTime": "2026-09-11T04:18:03.753000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-01T14:20:42.840513Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-01T14:20:42.894796Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "nginx/nginx@1.30.4-r1",
        "pcre2/pcre2@10.47-r1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "pcre2/pcre2",
      "version": "10.47-r1",
      "nearestFixedInVersion": "10.48-r0"
    },
    {
      "id": "SNYK-ALPINE324-PCRE2-20364480",
      "cpes": [],
      "title": "Free of Memory not on the Heap",
      "CVSSv3": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<10.48-r0"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "10.48-r0"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.8,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://github.com/PCRE2Project/pcre2/pull/937",
          "title": "https://github.com/PCRE2Project/pcre2/pull/937"
        },
        {
          "url": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48",
          "title": "https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.8,
          "modificationTime": "2026-09-17T01:30:42.876297Z"
        },
        {
          "assigner": "Red Hat",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-12T06:07:51.962108Z"
        },
        {
          "assigner": "SUSE",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "cvssV3BaseScore": 7.5,
          "modificationTime": "2026-09-18T11:06:26.133426Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.8,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-17T01:30:42.876297Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "assigner": "Red Hat",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-12T06:07:51.962108Z"
        },
        {
          "type": "secondary",
          "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "assigner": "SUSE",
          "severity": "high",
          "baseScore": 7.5,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-18T11:06:26.133426Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `pcre2` package and not the `pcre2` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nIn PCRE2 before 10.48, pcre2_jit_match mishandles a previously copied subject being passed in as a context. An incorrect free operation can occur.\n## Remediation\nUpgrade `Alpine:3.24` `pcre2` to version 10.48-r0 or higher.\n## References\n- [https://github.com/PCRE2Project/pcre2/pull/937](https://github.com/PCRE2Project/pcre2/pull/937)\n- [https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48](https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48)\n",
      "epssDetails": {
        "percentile": "0.01943",
        "probability": "0.00126",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-89161"
        ],
        "CWE": [
          "CWE-590"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "pcre2",
      "creationTime": "2026-10-01T14:20:51.276784Z",
      "disclosureTime": "2026-09-11T04:18:04.470000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-01T14:20:51.279254Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-01T14:20:51.351108Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "nginx/nginx@1.30.4-r1",
        "pcre2/pcre2@10.47-r1"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "pcre2/pcre2",
      "version": "10.47-r1",
      "nearestFixedInVersion": "10.48-r0"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [
        false,
        "zlib/zlib@1.3.2-r1"
      ],
      "isUpgradable": true,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1"
    },
    {
      "id": "SNYK-ALPINE324-ZLIB-20541555",
      "cpes": [],
      "title": "Out-of-bounds Write",
      "CVSSv3": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
      "credit": [
        ""
      ],
      "semver": {
        "vulnerable": [
          "<1.3.2-r1"
        ]
      },
      "exploit": "Not Defined",
      "fixedIn": [
        "1.3.2-r1"
      ],
      "patches": [],
      "insights": {
        "triageAdvice": null
      },
      "language": "linux",
      "severity": "high",
      "cvssScore": 7.4,
      "malicious": false,
      "isDisputed": false,
      "references": [
        {
          "url": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490",
          "title": "https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490"
        },
        {
          "url": "https://github.com/madler/zlib",
          "title": "https://github.com/madler/zlib"
        },
        {
          "url": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393",
          "title": "https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c%23L393"
        },
        {
          "url": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate",
          "title": "https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"
        }
      ],
      "cvssDetails": [
        {
          "assigner": "NVD",
          "severity": "high",
          "cvssV3Vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "cvssV3BaseScore": 7.4,
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "cvssSources": [
        {
          "type": "primary",
          "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "assigner": "NVD",
          "severity": "high",
          "baseScore": 7.4,
          "cvssVersion": "3.1",
          "modificationTime": "2026-09-04T01:29:18.339972Z"
        }
      ],
      "description": "## NVD Description\n**_Note:_** _Versions mentioned in the description apply only to the upstream `zlib` package and not the `zlib` package as distributed by `Alpine`._\n_See `How to fix?` for `Alpine:3.24` relevant fixed versions and status._\n\nzlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary.\n## Remediation\nUpgrade `Alpine:3.24` `zlib` to version 1.3.2-r1 or higher.\n## References\n- [https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490](https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490)\n- [https://github.com/madler/zlib](https://github.com/madler/zlib)\n- [https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393](https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393)\n- [https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate](https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate)\n",
      "epssDetails": {
        "percentile": "0.27225",
        "probability": "0.00356",
        "modelVersion": "v2026.06.15"
      },
      "identifiers": {
        "CVE": [
          "CVE-2026-85091"
        ],
        "CWE": [
          "CWE-787"
        ],
        "ALTERNATIVE": []
      },
      "nvdSeverity": "high",
      "packageName": "zlib",
      "creationTime": "2026-10-07T02:47:09.191969Z",
      "disclosureTime": "2026-09-03T13:06:20.573000Z",
      "exploitDetails": {
        "sources": [],
        "maturityLevels": [
          {
            "type": "secondary",
            "level": "Not Defined",
            "format": "CVSSv3"
          },
          {
            "type": "primary",
            "level": "Not Defined",
            "format": "CVSSv4"
          }
        ]
      },
      "packageManager": "alpine:3.24",
      "publicationTime": "2026-10-07T02:47:09.202336Z",
      "severityBasedOn": "CVSS",
      "modificationTime": "2026-10-08T15:12:02.001819Z",
      "socialTrendAlert": false,
      "relativeImportance": null,
      "severityWithCritical": "high",
      "from": [
        "docker-image|docker.io/scopear/docker-diagnostic-tools@1.6.0_afd4ece.284",
        "nginx/nginx@1.30.4-r1",
        "zlib/zlib@1.3.2-r0"
      ],
      "upgradePath": [],
      "isUpgradable": false,
      "isPatchable": false,
      "name": "zlib/zlib",
      "version": "1.3.2-r0",
      "nearestFixedInVersion": "1.3.2-r1"
    }
  ],
  "ok": false,
  "dependencyCount": 22,
  "org": "sean.graham",
  "policy": "# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.\nversion: v1.25.1\nignore: {}\npatch: {}\n",
  "isPrivate": true,
  "licensesPolicy": {
    "severities": {},
    "orgLicenseRules": {
      "AGPL-1.0": {
        "licenseType": "AGPL-1.0",
        "severity": "high",
        "instructions": ""
      },
      "AGPL-3.0": {
        "licenseType": "AGPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "Artistic-1.0": {
        "licenseType": "Artistic-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "Artistic-2.0": {
        "licenseType": "Artistic-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "CDDL-1.0": {
        "licenseType": "CDDL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "CPOL-1.02": {
        "licenseType": "CPOL-1.02",
        "severity": "high",
        "instructions": ""
      },
      "EPL-1.0": {
        "licenseType": "EPL-1.0",
        "severity": "medium",
        "instructions": ""
      },
      "GPL-2.0": {
        "licenseType": "GPL-2.0",
        "severity": "high",
        "instructions": ""
      },
      "GPL-3.0": {
        "licenseType": "GPL-3.0",
        "severity": "high",
        "instructions": ""
      },
      "LGPL-2.0": {
        "licenseType": "LGPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-2.1": {
        "licenseType": "LGPL-2.1",
        "severity": "medium",
        "instructions": ""
      },
      "LGPL-3.0": {
        "licenseType": "LGPL-3.0",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-1.1": {
        "licenseType": "MPL-1.1",
        "severity": "medium",
        "instructions": ""
      },
      "MPL-2.0": {
        "licenseType": "MPL-2.0",
        "severity": "medium",
        "instructions": ""
      },
      "MS-RL": {
        "licenseType": "MS-RL",
        "severity": "medium",
        "instructions": ""
      },
      "SimPL-2.0": {
        "licenseType": "SimPL-2.0",
        "severity": "high",
        "instructions": ""
      }
    }
  },
  "packageManager": "apk",
  "ignoreSettings": {
    "adminOnly": false,
    "reasonRequired": false,
    "disregardFilesystemIgnores": false,
    "autoApproveIgnores": false,
    "approvalWorkflowEnabled": false
  },
  "docker": {
    "os": {
      "prettyName": "Alpine Linux v3.24"
    }
  },
  "summary": "6 high or critical severity vulnerable dependency paths",
  "severityThreshold": "high",
  "filesystemPolicy": false,
  "filtered": {
    "ignore": [],
    "patch": []
  },
  "uniqueCount": 3,
  "projectName": "docker-image|docker.io/scopear/docker-diagnostic-tools",
  "platform": "linux/amd64",
  "hasUnknownVersions": false,
  "path": "docker.io/scopear/docker-diagnostic-tools:1.6.0_afd4ece.284/scopear/docker-diagnostic-tools"
}