{"id":"EUVD-2026-102160","revision":null,"records":[{"revision":"1f31d6a2f88e4fb7938d3b4d3447c2ba","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-100351","aliases":[],"title":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.","state":0,"publishedAt":"2026-10-15T15:52:30.041+00:00","modifiedAt":"2026-10-15T16:09:36.65+00:00","affected":[{"ecosystem":"Vendor product","name":"kin-openapi","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"getkin\",\n                    \"product\": \"kin-openapi\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 0.144.0, < 0.147.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-100351","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-100351","identifiers":["CVE-2026-100351"]},"retained":false,"historicalAffected":[]},{"revision":"08e3040d96b4447d8c23ca548c875b31","observedAt":"2026-11-09T04:15:10.749+00:00","statement":{"source":"euvd","id":"EUVD-2026-102160","aliases":["CVE-2026-100351","GHSA-23vg-4cjm-66q5"],"title":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath …","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":null}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102160","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 15, 2026, 3:52:30 PM","dateUpdated":"Oct 15, 2026, 4:09:36 PM"},"relatedAdvisories":[{"id":"RHSA-2026:87077","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-15577","CVE-2026-33374","CVE-2026-92539","CVE-2026-93294","CVE-2026-95502","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"RHSA-2026:85266","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-93450","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-110816"]},{"id":"RHSA-2026:82637","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354"]},{"id":"openSUSE-SU-2026:12309-1","title":"timoni-0.36.0-1.1 on GA media","vulnerabilityIds":["CVE-2024-45338","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-100351","CVE-2026-100352","CVE-2026-100353","CVE-2026-100354","CVE-2026-33186","CVE-2026-78659","CVE-2026-78660","CVE-2026-78663","CVE-2026-78669","CVE-2026-97032"]},{"id":"RHSA-2026:76677","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","vulnerabilityIds":["CVE-2024-24786","CVE-2026-56851","CVE-2026-61801","CVE-2026-95502","CVE-2026-97394","CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-101899","CVE-2026-109855"]},{"id":"openSUSE-SU-2026:12164-1","title":"hugo-0.168.0-2.1 on GA media","vulnerabilityIds":["CVE-2026-100347","CVE-2026-100348","CVE-2026-100349","CVE-2026-100350","CVE-2026-100351","CVE-2026-100352"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-102160","identifiers":["EUVD-2026-102160","CVE-2026-100351","GHSA-23vg-4cjm-66q5"]},"retained":false,"historicalAffected":[]},{"revision":"a07fc90c54c8423088395a27ff015595","observedAt":"2026-10-25T04:17:26.915+00:00","statement":{"source":"nvd","id":"CVE-2026-100351","aliases":[],"title":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath …","description":"kin-openapi is a Go project for handling OpenAPI files. From 0.144.0 until 0.147.0, openapi3filter.ValidationHandler validates an operation selected from decoded URL.Path while a downstream gorilla/mux router configured with UseEncodedPath can dispatch a different operation selected from URL.RawPath. When a public exact route and a protected parameterized route use the same method and overlap after decoding, an unauthenticated remote request containing an encoded path separator can be validated as public and then dispatched to the protected handler without invoking the configured AuthenticationFunc. The reachable path parameter is constrained to an encoded representation that decodes to the public literal route, and proxies that canonicalize the URI before forwarding prevent this specific mismatch. This issue is fixed in version 0.147.0.","state":0,"publishedAt":"2026-10-15T16:17:31.11+00:00","modifiedAt":"2026-10-15T17:17:07.52+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"}],"references":["https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0","https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-100351","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-289","CWE-436"],"productCriteria":[],"sourceDates":{"published":"2026-10-15T16:17:31.110","lastModified":"2026-10-15T17:17:07.520"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-100351","identifiers":["CVE-2026-100351"]},"retained":false,"historicalAffected":[]},{"revision":"0b0503f90efb4e528ff93856c85bf4d6","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GHSA-23vg-4cjm-66q5","aliases":["CVE-2026-100351","GO-2026-6769"],"title":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion","description":"## Summary\n\n`openapi3filter.ValidationHandler.Middleware` validates requests with kin-openapi's\nlegacy router, which selects an OpenAPI operation from the decoded `URL.Path`. The\nmethod is documented as implementing `gorilla/mux.MiddlewareFunc`, but a downstream\ngorilla/mux router configured with `UseEncodedPath()` selects its handler from the\nencoded representation (`URL.RawPath`).\n\nAn unauthenticated request such as `/public%2Fstatus` can therefore be validated as an\nintentionally public operation (`/public/status`) and then dispatched to a protected\noperation (`/{id}`). The configured, rejecting `AuthenticationFunc` is never invoked,\nand the protected downstream handler runs.\n\nThis is distinct from GHSA-r277-6w6q-xmqw. The behavior below uses an explicit\nauthentication callback that rejects missing credentials and remains reproducible\nafter the v0.144.0 fix for the unsafe default callback.\n\n## Affected products\n\n- Product: `github.com/getkin/kin-openapi`\n- Component: `openapi3filter.ValidationHandler.Middleware`\n- Confirmed post-GHSA affected releases: v0.144.0, v0.145.0, and v0.146.0\n- Reporter attestation: each listed release was checked out separately, the attached\n  single-file test was copied into `openapi3filter/`, and that test passed; maintainers\n  should independently confirm the version range\n- Confirmed affected development revision: `d33e44e67734dcde81b576582185e1343fb3985d`\n- v0.143.0 also reproduces this mechanism, but GHSA-r277-6w6q-xmqw already provides a\n  simpler bypass on that release; the distinct post-fix claim starts at v0.144.0\n- Earlier releases: not tested; please treat the introduction boundary as unknown\n\n## Security impact\n\nAn unauthenticated remote requester can reach a handler whose OpenAPI operation\nrequires authentication when all of the following are true:\n\n1. the application uses `ValidationHandler.Middleware` as the security gate;\n2. the downstream router preserves and interprets an encoded path, such as\n   gorilla/mux with `UseEncodedPath()`;\n3. a public exact route and a protected parameterized route overlap after decoding;\n4. the public and protected operations expose the same HTTP method;\n5. the protected handler relies on the validation layer's security decision.\n\nThe protected operation's path-parameter value is constrained: it is an encoded\nrepresentation that decodes to a public literal path (`public%2Fstatus` in this PoC),\nnot an arbitrary attacker-selected identifier. A protected operation without a\ncompatible parameterized path is not reachable through this specific mechanism.\n\n- Primitive: the security decision is made for a different OpenAPI operation than the\n  operation dispatched by the application router.\n- Demonstrated impact: a protected handler executes while the explicitly rejecting\n  `AuthenticationFunc` is never invoked.\n- Impact ceiling: confidentiality or integrity loss when the reachable protected\n  handler has that authority; the PoC does not demonstrate data disclosure or state\n  modification.\n- Availability impact: not demonstrated.\n\n## Root cause\n\nAt the confirmed development revision:\n\n- `openapi3filter/validation_handler.go`: `ValidationHandler.Load` constructs\n  `routers/legacy.NewRouter` unconditionally.\n- `routers/legacy/router.go`: route selection uses the decoded request path.\n- `routers/gorillamux/router.go`: the kin-openapi gorilla router constructs a\n  gorilla/mux router with `UseEncodedPath()`.\n- `ValidationHandler.Middleware` forwards the unchanged request after validation.\n\nThe component making the authentication decision and the component dispatching the\nhandler can therefore disagree about the selected operation.\n\n## Reproduction\n\nThe attached PoC uses a real `net/http` server, an explicit API-key callback that\nrejects missing credentials, and a downstream gorilla/mux router with\n`UseEncodedPath()`.\n\nFrom a kin-openapi checkout, copy the self-contained attachment\n`encoded_path_route_confusion_test.go.txt` into `openapi3filter/` as\n`encoded_path_route_confusion_test.go`, then run:\n\n```sh\ngo test -v ./openapi3filter -run '^TestEncodedPathAuthorizationBypass$' -count=1\n```\n\nExpected attack observation:\n\n```text\nstatus=202 downstream_route=/{id} protected_id=public%2Fstatus authentication_calls=0\nwiring=Router.Use status=202 downstream_route=/{id} protected_id=public%2Fstatus authentication_calls=0\n```\n\nControls included in the test show that:\n\n- `/ordinary` selects the protected operation, invokes authentication once, and is\n  rejected with HTTP 401;\n- `/public/status` reaches only the intentionally public handler;\n- the encoded request reaches the protected `/{id}` handler with HTTP 202 while the\n  authentication callback remains uncalled;\n- both external wrapping and the documented\n  `router.Use(validationHandler.Middleware)` wiring reproduce the same result.\n\n## Reverse-proxy reachability\n\nThe same request was reproduced through Nginx 1.31.3 using the official\n`nginx:alpine` image digest\n`sha256:4a73073bd557c65b759505da037898b61f1be6cbcc3c2c3aeac22d2a470c1752`.\n\nThe exact container invocation was:\n\n```sh\ndocker run --rm --name kin-openapi-nginx \\\n  --add-host=host.docker.internal:host-gateway \\\n  -p 18081:8080 -p 18082:8081 \\\n  -v \"$PWD/poc/nginx.conf:/etc/nginx/nginx.conf:ro\" \\\n  nginx:alpine\n```\n\nContainer port 8080 uses `proxy_pass http://host.docker.internal:18080;` without a\nreplacement URI. Host port 18081 therefore preserved `/public%2Fstatus`; the protected\nhandler returned HTTP 202 and the\nauthentication callback remained at zero calls. With\n`proxy_pass http://host.docker.internal:18080/;` on container port 8081 / host port\n18082, Nginx canonicalized the upstream URI; both layers selected `/public/status` and\nthe bypass did not occur.\n\nNginx access-log observations:\n\n```text\nserver_port=8080 \"GET /public%2Fstatus HTTP/1.1\" 202 0 \"curl/8.7.1\"\nserver_port=8081 \"GET /public%2Fstatus HTTP/1.1\" 204 0 \"curl/8.7.1\"\nserver_port=8080 \"GET /ordinary HTTP/1.1\" 401 0 \"curl/8.7.1\"\n```\n\nThe response route headers were `X-Poc-Route: /{id}` on the preserving listener and\n`X-Poc-Route: /public/status` on the canonicalizing listener. Backend observations for\nthe two requests were:\n\n```text\nrequest_uri=\"/public%2Fstatus\" path=\"/public/status\" raw_path=\"/public%2Fstatus\" auth_before=0\ncompleted request_uri=\"/public%2Fstatus\" auth_after=0\nrequest_uri=\"/public/status\" path=\"/public/status\" raw_path=\"\" auth_before=0\ncompleted request_uri=\"/public/status\" auth_after=0\n```\n\nThis control shows that upstream path handling is a deployment precondition rather\nthan claiming that every proxy configuration is affected.\n\nThe canonical protected control produced:\n\n```text\nrequest_uri=\"/ordinary\" path=\"/ordinary\" raw_path=\"\" auth_before=0\ncompleted request_uri=\"/ordinary\" auth_after=1\n```\n\n## Suggested remediation\n\nThe authentication layer and downstream dispatcher must select the same OpenAPI\noperation from the same request representation.\n\nPotential approaches:\n\n1. make `ValidationHandler` accept a caller-supplied `routers.Router` and require it to\n   match downstream routing semantics;\n2. document that `NewValidator` already accepts a router but is safe only when the\n   supplied router selects operations using the same semantics as the dispatcher;\n   callers must also supply an `AuthenticationFunc` through `ValidationOptions`, or\n   protected requests fail with the existing missing-authentication-service error;\n3. as an interim hardening option, make `ValidationHandler` fail closed on an encoded\n   path separator when `URL.Path` and `URL.RawPath` can select different operations,\n   and verify this behavior against the full suite;\n4. document the route-identity requirement and add encoded-separator regression tests.\n\nReplacing the legacy router with the kin-openapi gorilla router closes this PoC, but a\nlocal compatibility check changed two existing missing-path-parameter tests from HTTP\n400 semantics to route-not-found HTTP 404 semantics. A direct router swap is therefore\nnot a fully validated drop-in fix.\n\n## Public-reference triage\n\nThe public advisory list and related path-encoding reports reviewed on 2026-08-18 did\nnot describe this authentication-boundary crossing. Relevant nearby reports include\nissues #397, #1089, and #1105 and PR #400. This search is not proof of novelty; please\ndeduplicate against private reports.\n\n## Credit\n\nPreferred credit: Satoru Kanno (GMO CONNECT Inc., GMO Internet Group, Inc.)","state":0,"publishedAt":"2026-10-15T20:19:20+00:00","modifiedAt":"2026-11-05T23:25:57.3340842+00:00","affected":[{"ecosystem":"Go","name":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.144.0"},{"kind":"fixed","version":"0.147.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","https://nvd.nist.gov/vuln/detail/CVE-2026-100351","https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"],"sourceUrl":"https://github.com/advisories/GHSA-23vg-4cjm-66q5","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-23vg-4cjm-66q5","identifiers":["GHSA-23vg-4cjm-66q5","CVE-2026-100351","GO-2026-6769"]},"retained":false,"historicalAffected":[]},{"revision":"9d086decbeb142d09c2b03a47178b36b","observedAt":"2026-11-05T23:38:32.248+00:00","statement":{"source":"osv","id":"GO-2026-6769","aliases":["CVE-2026-100351","GHSA-23vg-4cjm-66q5"],"title":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi","description":"kin-openapi: ValidationHandler security-requirement bypass via encoded-path operation confusion in github.com/getkin/kin-openapi","state":0,"publishedAt":"2026-11-05T22:53:53+00:00","modifiedAt":"2026-11-05T23:15:12.6489759+00:00","affected":[{"ecosystem":"Go","name":"github.com/getkin/kin-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0.144.0"},{"kind":"fixed","version":"0.147.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/getkin/kin-openapi/security/advisories/GHSA-23vg-4cjm-66q5","https://nvd.nist.gov/vuln/detail/CVE-2026-100351","https://github.com/getkin/kin-openapi/commit/eda80e2676e9f577ceed2dd80e64f16083edb041","https://github.com/getkin/kin-openapi/releases/tag/v0.147.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6769","license":"OSV · upstream source license applies","key":"osv:GO-2026-6769","identifiers":["GO-2026-6769","CVE-2026-100351","GHSA-23vg-4cjm-66q5"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1621362+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1621395+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-49ad16fb0d34ddf0ae41aa46fedfe58e1df7005677e5f3c7ea3ce3ccbb1e0589","complete":true,"records":421457,"lastAttemptAt":"2026-11-09T15:02:15.2169676+00:00","lastSuccessAt":"2026-11-09T15:02:15.1121329+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:15.2169676+00:00","snapshotPublishedAt":"2026-11-09T14:25:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-1cda4ef84588402c81419af30caa5cf1","complete":false,"records":13655,"lastAttemptAt":"2026-11-09T15:16:31.927767+00:00","lastSuccessAt":"2026-11-09T15:16:31.919+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T15:16:31.919+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13698,"expectedIdentifiers":13707,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T15:04:17.9226009+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T15:04:17.9226009+00:00","lastSuccessAt":"2026-11-09T15:04:18.1628494+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:18.1628497+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-122e73413fbf41e4b6ede4e4f5660885","complete":true,"records":13667,"lastAttemptAt":"2026-11-09T15:04:19.7498555+00:00","lastSuccessAt":"2026-11-09T15:04:19.744+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:19.744+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13707,"expectedIdentifiers":13707,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T15:04:17.5233893+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.5233893+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T15:02:16.0914115+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:02:16.0914115+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-c905fa1bd26c7b261e77cc7202a86dc766ff31c2b096b501f3bf44f561e34970","complete":true,"records":3063,"lastAttemptAt":"2026-11-09T15:04:17.8913143+00:00","lastSuccessAt":"2026-11-09T12:02:21.7931207+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.8913143+00:00","snapshotPublishedAt":"2026-11-09T11:18:00+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-c5775280c9de3927e2aad763cbfbebcc2ac79b903f8410c65ab9bc1096f5fa3d","complete":true,"records":231299,"lastAttemptAt":"2026-11-09T15:04:17.3926133+00:00","lastSuccessAt":"2026-11-09T15:04:15.9950254+00:00","error":null,"lastVerifiedAt":"2026-11-09T15:04:17.3926133+00:00","snapshotPublishedAt":"2026-11-09T14:33:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}