{ "bomFormat": "CycloneDX", "specVersion": "1.5", "serialNumber": "urn:uuid:039f4c05-d9ae-5192-9a03-bfd6a6a0be8a", "version": 1, "metadata": { "timestamp": "2026-08-25T04:31:01Z", "component": { "type": "application", "bom-ref": "pihole-by-rajannpatel@amd64", "name": "pihole-by-rajannpatel", "purl": "pkg:snap/pihole-by-rajannpatel?arch=amd64" }, "tools": [ { "vendor": "snap-pi-hole", "name": "summarize_osv_reports.py" } ] }, "vulnerabilities": [ { "bom-ref": "vex-amd64-bind9-CVE-2026-13204", "id": "CVE-2026-13204", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-13204" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-07-22T15:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/bind9@1%3A9.20.24-1ubuntu0.2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This finding does not apply to the operational runtime of snap-pi-hole. The snap's DNS resolution service is provided by the compiled pihole-FTL daemon (which vendors and embeds dnsmasq), not the ISC BIND daemon (named). Although bind9 utility packages or shared libraries may be staged from the Ubuntu core26 archive, the BIND server DNSSEC validation routines containing this assertion failure are not executed to serve network DNS queries. Furthermore, under strict confinement (AppArmor, seccomp, and a read-only SquashFS root), uninvoked binaries cannot be reached by network traffic, and no host or resolver compromise is possible." } }, { "bom-ref": "vex-amd64-jq-CVE-2025-9403", "id": "CVE-2025-9403", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2025-9403" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2025-08-25T03:15:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is confined to the jq test suite harness (`run_jq_tests` in `jq_test.c`) and does not affect the production `jq` binary shipped in the snap from the Ubuntu archive. Test suite functions are not compiled into the shipping CLI executable or invoked by the snap's runtime scripts. Invocations of `jq` within the snap (such as in `snap/local/patches/updatecheck.patch` and `snap/hooks/configure`) execute the standard command-line utility, meaning the vulnerable test harness code path is not present or reachable. Even during runtime utility execution, AppArmor and seccomp contain helper processes to their declared interfaces without granting host-level modification rights." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-40612", "id": "CVE-2026-40612", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-40612" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This issue in jq's `jv_contains` function causes unbounded recursion and stack exhaustion when recursively evaluating deeply nested array or object structures via containment operations. In this snap, `jq` is utilized as a helper utility in shell scripts and hooks, notably in `updatecheck.patch` parsing the GitHub release tag (`jq --raw-output .tag_name`) and within configuration hook scripts (`snap/hooks/configure`, `pihole-config.sh`). None of the audited invocations invoke the `contains` filter on untrusted or deeply nested programmatic structures; the update checker only extracts top-level properties and handles failures via fallback (`|| echo \"null\"`). Furthermore, `jq` runs as an ephemeral subprocess inside helper scripts, distinct from the long-running `pihole-FTL` daemon, and does not hold host-modifying interfaces (*-control). Any theoretical crash in `jq` is contained to that short-lived execution and cannot compromise the host, corrupt persistent state, or interrupt core DNS name resolution." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-41256", "id": "CVE-2026-41256", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-41256" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is triggered when jq loads a top-level program from a crafted filter file via the -f argument containing an embedded NUL byte, resulting in a compilation mismatch where only the prefix before the NUL is compiled. In this snap, reachability is not evident from the audited evidence: every audited invocation in snap/local/patches/updatecheck.patch, snap/hooks/configure, and snap/local/runtime/pihole-config.sh supplies inline filter expressions (e.g., .tag_name, jq -r, jq -n -R) directly on the command line rather than loading external filter scripts via -f. Furthermore, jq executes strictly within short-lived shell CLI contexts, snapd hooks, and wrapper scripts rather than within the core pihole-FTL daemon. These utility contexts operate under strict snap confinement (read-only SquashFS, seccomp filters, and restricted AppArmor profiles) without holding host-reaching interfaces such as firewall-control or network-control. Any parsing anomaly would at most result in an isolated filter failure in a helper process without endangering host integrity or DNS resolver operation." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-41257", "id": "CVE-2026-41257", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-41257" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability involves signed integer overflow in jq's bytecode VM data stack allocation when executing deeply nested generator forks that expand the stack beyond 1 GiB. In this snap, reachability is not evident from the audited evidence: all audited jq invocations use static, fixed filter expressions such as .tag_name or specific configuration migration keys, none of which utilize generator recursion or deep VM branch iteration capable of driving stack allocation to 1 GiB. Moreover, jq runs strictly as an auxiliary CLI tool in shell wrapper scripts and snapd hooks, not inside the long-running pihole-FTL daemon. It possesses no host-reaching capabilities (such as process-control or network-control), and memory-safety anomalies in these one-shot utility executions are fully contained by the snap's seccomp filters, AppArmor sandbox, and read-only root filesystem." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-43894", "id": "CVE-2026-43894", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-43894" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.2, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is caused by an integer overflow in decNumberFromString when parsing a numeric literal containing over 2 billion digits (INT_MAX-1), causing a stack buffer overflow. In this snap, untrusted JSON data reaches jq exclusively via snap/local/patches/updatecheck.patch, which queries the GitHub releases API. While external API data is ingested, triggering this condition would require delivering a multi-gigabyte JSON payload containing a 2.14-billion-digit number. If triggered, jq executes in a transient shell process under the CLI profile rather than within the pihole-FTL daemon. The update check script explicitly guards execution with a fallback (|| echo \"null\"), so a process crash simply causes the update check to report null. Strict confinement (AppArmor, seccomp, and the read-only SquashFS root) prevents arbitrary code execution from reaching host resources or escaping the sandbox, and the core DNS resolver service remains entirely unaffected." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-43895", "id": "CVE-2026-43895", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-43895" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.4, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is an input-validation mismatch in jq's module and data-file import resolution when handling paths with embedded NUL bytes. In this snap, jq is staged as a pre-built binary from the Ubuntu archive and executed exclusively as a command-line utility within POSIX shell scripts, snapd hooks, and wrapper diagnostics (such as snap/hooks/configure and updatecheck.patch). Reachability of the vulnerable module-import mechanism is not evident from the audited evidence, as all invocation sites supply static, hardcoded jq filter expressions (e.g., extracting .tag_name from the GitHub API or manipulating internal configuration keys) rather than dynamic or untrusted jq program code that uses the import directive. Furthermore, jq runs within ephemeral hook and CLI contexts rather than inside the long-running pihole-FTL daemon, meaning it does not operate with host-reaching interface grants such as firewall-control or network-control. Under strict confinement, AppArmor, seccomp, and the read-only SquashFS root ensure that even if an invalid file path were resolved, file access is constrained entirely to authorized snap directories." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-43896", "id": "CVE-2026-43896", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-43896" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.2, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This flaw allows a crafted jq program employing the multiplication/merge operator (*) on nested objects to trigger unbounded recursion in jv_object_merge_recursive(), resulting in a process crash via segmentation fault. Within this snap, jq is used purely as an interpreted CLI tool for internal configuration parsing and update checks. Reachability is not evident from the audited call sites, as none of the scripted invocations evaluate untrusted jq scripts or invoke the recursive object merge operator on arbitrary nested objects; the queries are simple, fixed selectors such as .tag_name or basic scalar formatters. The execution context is confined to short-lived helper processes and snapd hooks, completely separate from the core pihole-FTL DNS resolver daemon. Even if an unexpected crash were triggered by malformed input from an external source such as the GitHub release API, the blast radius is strictly limited to the termination of the individual helper script invocation without degrading network-wide DNS availability, corrupting persistent state, or compromising host boundaries." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-44777", "id": "CVE-2026-44777", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-44777" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-05-11T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This issue involves infinite recursion and subsequent stack exhaustion in jq's module loader when handling cyclic module dependencies via include statements. In the snap-pi-hole environment, jq is staged as a standard Ubuntu archive binary and invoked across shell hooks and configuration scripts. Reachability is not evident from the audited evidence because the snap's runtime scripts execute self-contained, inline jq filters and do not load, include, or import external jq modules or libraries. Untrusted input encountered by jq is parsed purely as JSON data payloads (such as API responses or configuration values) rather than jq language source modules. Because jq executes in isolated helper and hook processes without elevated privileges or host-reaching interface bindings, AppArmor confinement and seccomp filtering fully isolate process execution, preventing any broader availability or integrity impact on the underlying host or the pihole-FTL service." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-47770", "id": "CVE-2026-47770", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-47770" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-06-25T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is an uncontrolled recursion flaw in jq's structural comparison logic (src/jv.c: jvp_array_equal(), jv_equal() and src/jv_aux.c: jv_cmp()) leading to stack exhaustion when evaluating the '==' operator or sort comparators on deeply nested JSON arrays. In this snap, jq is staged as a pre-built binary from the Ubuntu archive and executed exclusively as a transient CLI utility in POSIX shell wrapper scripts, snapd hooks, and update checks, rather than linked into the core compiled C daemon (pihole-FTL). Audited invocations show jq being used for specific JSON field extractions (e.g., '.tag_name' in updatecheck.patch) and configuration transformations (in snap/hooks/configure and pihole-config.sh); reachability of the vulnerable '==' recursive comparison on untrusted nested input is not evident from the audited evidence. Even if a malformed payload were supplied via the GitHub release check, the pipeline includes fallback handling ('|| echo \"null\"') and fails isolated within a short-lived subprocess. Strict snap confinement (AppArmor profile, seccomp filters, and read-only SquashFS root) strictly bounds the execution context of hook and CLI apps to standard observation interfaces without host-reaching control grants, completely mitigating any broader host compromise or persistence risk." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-49839", "id": "CVE-2026-49839", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-49839" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.1, "method": "CVSSv3" } ], "published": "2026-06-25T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This finding describes an invalid-state reuse and heap out-of-bounds write occurring inside jv_load_file() when jq is invoked with the '--rawfile' flag on an oversized input file. In the snap-pi-hole distribution, jq is an interpreted helper utility used in shell-level administrative hooks and runtime helper scripts. An inspection of the snap's call sites (updatecheck.patch, snap/hooks/configure, and pihole-config.sh) confirms that jq is invoked with flags such as '-r', '--raw-output', and '-n -R', and never with the '--rawfile' option. Reachability of the vulnerable code path is therefore not evident from the audited interfaces. Furthermore, jq runs within isolated, transient CLI executions that do not hold the host-reaching interfaces declared by pihole-ftl (such as firewall-control or network-control), and the read-only SquashFS core together with strict AppArmor containment prevents arbitrary host filesystem modification or sandbox escape." } }, { "bom-ref": "vex-amd64-jq-CVE-2026-54679", "id": "CVE-2026-54679", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-54679" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-06-25T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability involves an integer overflow in jvp_string_append() on 32-bit architectures (relevant only when deployed on 32-bit targets such as armhf) when concatenating exceptionally large strings, leading to a heap buffer overrun. In this snap, jq is not compiled into the primary pihole-FTL daemon but is staged from the base archive to process small operational payloads, such as GitHub API release metadata and local configuration migration strings. The transmission of multi-gigabyte JSON strings across these audited internal helper paths is not evident from the audited evidence. Moreover, jq executes within the confined boundary of short-lived helper tools and hooks under strict seccomp filtering and AppArmor confinement, precluding host compromise or impact on the core DNS resolution daemon." } }, { "bom-ref": "vex-amd64-libssh2-CVE-2026-66032", "id": "CVE-2026-66032", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-66032" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 8.8, "method": "CVSSv3" } ], "published": "2026-07-24T17:17:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is a client-side double-free in libssh2's sftp_open() triggered when interacting with a malicious or compromised SFTP server. In the snap-pi-hole deployment, the core service is a network-wide DNS resolver (pihole-FTL) and administrative web interface; neither daemon acts as an SFTP client or connects to arbitrary remote SSH servers during normal operations. Reachability of libssh2 SFTP routines from attacker-controlled inputs is not evident from the audited evidence. Furthermore, under strict snap confinement, the read-only SquashFS filesystem, AppArmor profile, and seccomp filters prevent unauthorized host modifications, memory tampering across process boundaries, or arbitrary code persistence on the host. Because client-side SFTP sessions are not exposed to untrusted network input in this snap, the vulnerability is fully contained." } }, { "bom-ref": "vex-amd64-libssh2-CVE-2026-66033", "id": "CVE-2026-66033", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-66033" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-07-24T17:17:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This issue is a client-side integer underflow and denial-of-service in libssh2's ssh2_cipher_crypt() that occurs during AES-GCM cipher negotiation when connecting to an adversarial SSH server. In snap-pi-hole, network services consist of inbound DNS resolution on port 53 and HTTP/HTTPS administrative endpoints; outbound SSH connections negotiating SSH2 ciphers are not part of regular network request handling or daemon operations. Reachability of the affected handshake logic via untrusted inputs is not evident from the audited evidence. Even if libssh2 binaries are staged as transitive archive dependencies, snap confinement (AppArmor profiles, seccomp filters, and read-only SquashFS) confines runtime processes to their isolated environment, and the DNS service's availability remains unaffected." } }, { "bom-ref": "vex-amd64-libssh2-CVE-2026-66034", "id": "CVE-2026-66034", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-66034" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-07-24T17:17:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability involves an out-of-bounds heap read and uninitialized pointer free in libssh2's libssh2_publickey_list_fetch() function, triggered by parsing malformed version 1 publickey responses from a remote SSH server. In this snap architecture, pihole-FTL does not consume publickey subsystem responses from untrusted SSH servers during routine operation, making reachability not evident from the audited evidence. AppArmor policies, seccomp syscall filters, and the read-only root filesystem prevent host compromise, and the core DNS sinkhole workflows do not interface with remote SSH publickey endpoints." } }, { "bom-ref": "vex-amd64-libssh2-CVE-2026-66035", "id": "CVE-2026-66035", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-66035" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-07-24T17:17:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is a client-side heap buffer overflow in libssh2's transport layer (fullpacket()) triggered when connecting to a malicious SSH server during Encrypt-then-MAC cipher negotiation. In the snap-pi-hole build provenance, the core compiled daemon pihole-FTL links against mbedTLS, nettle, sqlite3, libidn2, libuv, and lmdb; libssh2 is not linked into pihole-FTL nor is it part of the daemon's runtime dependencies. Reachability of libssh2 client connection routines processing untrusted SSH server packets is not evident from the audited evidence, as the snap operates as an inbound DNS and HTTP/HTTPS server rather than initiating automated outbound SSH client sessions. Furthermore, even if an auxiliary utility dynamically linked libssh2, strict confinement via AppArmor, seccomp system-call filtering, and the read-only SquashFS root filesystem prevents arbitrary host modification, kernel exploitation, or unauthorized process tampering." } }, { "bom-ref": "vex-amd64-libxml2-CVE-2026-11979", "id": "CVE-2026-11979", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-11979" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.8, "method": "CVSSv3" } ], "published": "2026-06-29T14:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/libxml2@2.15.2%2Bdfsg-0.1ubuntu0.1?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This flaw is a stack-based buffer overflow in the interactive shell mode (usershell()) of the standalone xmlcatalog utility provided by libxml2, triggered by overly long input lines. The vulnerability resides specifically within the CLI tool's interactive shell interface rather than the core XML parsing library APIs utilized by services. In snap-pi-hole, the runtime services (the pihole-FTL daemon and PHP/JS web assets) do not invoke or expose the interactive xmlcatalog --shell command to untrusted network inputs; reachability is not evident from the audited evidence. Under strict confinement, any manual invocation of shell utilities is restricted by AppArmor profiles and seccomp filters that isolate the execution environment and block access to host resources outside the snap's sandbox." } }, { "bom-ref": "vex-amd64-lmdb-CVE-2026-22185", "id": "CVE-2026-22185", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-22185" }, "published": "2026-01-07T21:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/lmdb@0.9.31-1build2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This finding describes a 1-byte heap buffer underflow in the readline() function of the mdb_load database utility when parsing malformed text input with embedded NUL bytes. The flaw is confined to the mdb_load command-line utility and does not affect the core LMDB shared library database engine (liblmdb) embedded in or linked by daemon processes. The snap's DNS, DHCP, and web administration workflows do not ingest or process untrusted database dumps via mdb_load during normal network operations, making reachability not evident from the audited evidence. Moreover, strict snap confinement encloses all helper utilities under AppArmor and seccomp controls with a read-only root filesystem, ensuring that any crash or memory corruption in a utility is strictly bounded to that transient process." } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2018-1000520", "id": "CVE-2018-1000520", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2018-1000520" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2018-06-26T16:29:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2021-24119", "id": "CVE-2021-24119", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2021-24119" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.9, "method": "CVSSv3" } ], "published": "2021-07-14T13:15:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2025-49087", "id": "CVE-2025-49087", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2025-49087" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.0, "method": "CVSSv3" } ], "published": "2025-07-20T19:15:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2025-49600", "id": "CVE-2025-49600", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2025-49600" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.9, "method": "CVSSv3" } ], "published": "2025-07-04T15:15:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability involves unchecked return values in mbedtls_lms_verify during Leighton-Micali Signature (LMS) verification, which can lead to signature forgery specifically when combined with hardware fault injection against a hardware cryptographic accelerator. While mbedTLS is staged as a pre-built binary from the Ubuntu archive and dynamically linked into the compiled pihole-FTL daemon, Leighton-Micali stateful hash-based signatures are not utilized in Pi-hole's DNS, DNSSEC, or web management workflows, making reachability not evident from the audited evidence. Furthermore, the vulnerability requires physical or electrical fault injection against hardware accelerators, which is outside the threat model of a network-adjacent DNS resolver. Even if cryptographic routines within pihole-FTL were invoked, strict snap confinement enforces AppArmor profiles, seccomp filters, and a read-only SquashFS root filesystem, preventing any host-level filesystem modification or escalation beyond the daemon's runtime boundary." } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2025-49601", "id": "CVE-2025-49601", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2025-49601" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.5, "method": "CVSSv3" } ], "published": "2025-07-04T15:15:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is an out-of-bounds read in mbedtls_lms_import_public_key when parsing a truncated LMS public key buffer of fewer than four bytes, potentially resulting in a process crash or minor adjacent memory disclosure. Although mbedTLS is linked into the pihole-FTL daemon\u2014which declares host-reaching interfaces such as firewall-control, network-control, process-control, and time-control\u2014LMS key import functions are not utilized by Pi-hole for standard DNS resolution, web UI TLS termination, or API operations, so reachable exposure to untrusted input is not evident from the audited interfaces. If an in-memory crash were theoretically triggered within pihole-FTL, AppArmor confinement and seccomp syscall filtering restrict the daemon from escaping to the host or accessing arbitrary system files, and the official impact is limited to availability without arbitrary code execution or host interface manipulation established." } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2025-66442", "id": "CVE-2025-66442", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2025-66442" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.1, "method": "CVSSv3" } ], "published": "2026-04-01T20:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is a compiler-induced timing side channel in RSA and CBC/ECB decryption that strictly requires code generation from LLVM's select-optimize optimization pass. Per the project's build and runtime provenance, the compiled C daemon pihole-FTL is built via CMake using the standard GNU toolchain (GCC / build-essential), and third-party staged libraries including mbedTLS are pulled directly from the Ubuntu archive where they are built with GCC rather than LLVM/Clang. Because neither the daemon nor its staged mbedTLS binary are compiled with LLVM's select-optimize feature, the vulnerable compiler transformation is not present in the shipped snap binaries, rendering the vulnerability inapplicable to this build." } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-25832", "id": "CVE-2026-25832", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-25832" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-25833", "id": "CVE-2026-25833", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-25833" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-04-01T19:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-25834", "id": "CVE-2026-25834", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-25834" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.5, "method": "CVSSv3" } ], "published": "2026-04-01T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-25835", "id": "CVE-2026-25835", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-25835" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.7, "method": "CVSSv3" } ], "published": "2026-04-01T19:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34871", "id": "CVE-2026-34871", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34871" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.7, "method": "CVSSv3" } ], "published": "2026-04-01T19:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34872", "id": "CVE-2026-34872", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34872" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "critical", "score": 9.1, "method": "CVSSv3" } ], "published": "2026-04-01T20:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34873", "id": "CVE-2026-34873", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34873" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "critical", "score": 9.1, "method": "CVSSv3" } ], "published": "2026-04-01T21:17:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34874", "id": "CVE-2026-34874", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34874" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-04-01T19:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34875", "id": "CVE-2026-34875", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34875" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "critical", "score": 9.8, "method": "CVSSv3" } ], "published": "2026-04-01T18:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34876", "id": "CVE-2026-34876", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34876" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.5, "method": "CVSSv3" } ], "published": "2026-04-02T16:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-34877", "id": "CVE-2026-34877", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-34877" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "critical", "score": 9.8, "method": "CVSSv3" } ], "published": "2026-04-02T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-35336", "id": "CVE-2026-35336", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35336" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-49300", "id": "CVE-2026-49300", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-49300" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50579", "id": "CVE-2026-50579", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50579" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50580", "id": "CVE-2026-50580", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50580" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50581", "id": "CVE-2026-50581", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50581" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50583", "id": "CVE-2026-50583", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50583" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50584", "id": "CVE-2026-50584", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50584" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50585", "id": "CVE-2026-50585", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50585" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50586", "id": "CVE-2026-50586", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50586" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50587", "id": "CVE-2026-50587", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50587" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50588", "id": "CVE-2026-50588", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50588" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50640", "id": "CVE-2026-50640", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50640" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-50713", "id": "CVE-2026-50713", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-50713" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-54435", "id": "CVE-2026-54435", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-54435" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-mbedtls-CVE-2026-54441", "id": "CVE-2026-54441", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-54441" }, "published": "2026-07-23T00:00:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35341", "id": "CVE-2026-35341", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35341" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.1, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35344", "id": "CVE-2026-35344", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35344" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "low", "score": 3.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35345", "id": "CVE-2026-35345", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35345" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability in the uutils rust-coreutils implementation of tail occurs when `--follow=name` follows a replaced symbolic link into an unauthorized file path, leading to local arbitrary file read if a privileged tail process monitors a directory writable by an unprivileged attacker. In this snap, execution occurs entirely under strict confinement within an isolated mount namespace, seccomp filters, and AppArmor profiles. Host sensitive files (such as the host's `/etc/shadow`) are not present in the snap's mount namespace and are inaccessible. Furthermore, the snap's root filesystem is a read-only SquashFS, and writable state is restricted to `$SNAP_DATA` and `$SNAP_COMMON`. Any diagnostic or CLI log viewing (such as `pihole -t`) runs in confined shell wrappers where unprivileged multi-user symlink manipulation of monitored runtime paths is not evident from audited interfaces. Even if a symlink redirection occurred within the snap, the blast radius is strictly capped to the snap's own isolated environment and read-only assets, preventing disclosure of host-level secrets." } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35348", "id": "CVE-2026-35348", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35348" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35350", "id": "CVE-2026-35350", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35350" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.6, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35351", "id": "CVE-2026-35351", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35351" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.2, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35352", "id": "CVE-2026-35352", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35352" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.0, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35354", "id": "CVE-2026-35354", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35354" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.7, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "not_affected", "justification": "protected_at_runtime", "detail": "This vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the uutils coreutils `mv` implementation when preserving extended attributes (xattrs) across filesystem boundaries, allowing a local attacker with write access to the source or destination directory to swap files and corrupt security xattrs. In the context of this snap, reachability is not evident from the audited evidence: runtime file operations in wrapper scripts and hooks execute on internal data directories ($SNAP_DATA and $SNAP_COMMON) that are strictly owned by root/the service and not writable by untrusted local users. Furthermore, strict snap confinement enforces AppArmor profiles and mount namespaces that prevent unconfined local unprivileged users from manipulating internal snap directories or leveraging mismatched file attributes. Because the flaw requires local directory write access to race file operations and the snap's operational state is isolated from untrusted local actors, the risk is fully mitigated." } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35357", "id": "CVE-2026-35357", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35357" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.7, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35359", "id": "CVE-2026-35359", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35359" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.7, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35360", "id": "CVE-2026-35360", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35360" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35363", "id": "CVE-2026-35363", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35363" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.6, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35364", "id": "CVE-2026-35364", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35364" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35367", "id": "CVE-2026-35367", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35367" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "low", "score": 3.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35368", "id": "CVE-2026-35368", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35368" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "high", "score": 7.8, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35370", "id": "CVE-2026-35370", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35370" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 4.4, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35371", "id": "CVE-2026-35371", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35371" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "low", "score": 3.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35373", "id": "CVE-2026-35373", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35373" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 5.5, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35374", "id": "CVE-2026-35374", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35374" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "medium", "score": 6.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } }, { "bom-ref": "vex-amd64-rust-coreutils-CVE-2026-35377", "id": "CVE-2026-35377", "source": { "name": "OSV", "url": "https://ubuntu.com/security/CVE-2026-35377" }, "ratings": [ { "source": { "name": "OSV" }, "severity": "low", "score": 3.3, "method": "CVSSv3" } ], "published": "2026-04-22T17:16:00Z", "affects": [ { "ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64" } ], "analysis": { "state": "in_triage" } } ], "components": [ { "type": "library", "bom-ref": "pkg:deb/ubuntu/bind9@1%3A9.20.24-1ubuntu0.2?arch=amd64", "name": "bind9", "purl": "pkg:deb/ubuntu/bind9@1%3A9.20.24-1ubuntu0.2?arch=amd64", "version": "1:9.20.24-1ubuntu0.2" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64", "name": "jq", "purl": "pkg:deb/ubuntu/jq@1.8.1-4ubuntu2?arch=amd64", "version": "1.8.1-4ubuntu2" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64", "name": "libssh2", "purl": "pkg:deb/ubuntu/libssh2@1.11.1-1ubuntu0.26.04.3?arch=amd64", "version": "1.11.1-1ubuntu0.26.04.3" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/libxml2@2.15.2%2Bdfsg-0.1ubuntu0.1?arch=amd64", "name": "libxml2", "purl": "pkg:deb/ubuntu/libxml2@2.15.2%2Bdfsg-0.1ubuntu0.1?arch=amd64", "version": "2.15.2+dfsg-0.1ubuntu0.1" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/lmdb@0.9.31-1build2?arch=amd64", "name": "lmdb", "purl": "pkg:deb/ubuntu/lmdb@0.9.31-1build2?arch=amd64", "version": "0.9.31-1build2" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64", "name": "mbedtls", "purl": "pkg:deb/ubuntu/mbedtls@3.6.5-0.1ubuntu2?arch=amd64", "version": "3.6.5-0.1ubuntu2" }, { "type": "library", "bom-ref": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64", "name": "rust-coreutils", "purl": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64", "version": "0.8.0-0ubuntu3" } ] }