{"id":"EUVD-2026-66715","revision":null,"records":[{"revision":"bf3bb108b37e431082083716c76a2bc3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-79921","aliases":[],"title":"amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":"2026-08-26T20:24:58.115+00:00","modifiedAt":"2026-08-29T02:50:25.822+00:00","affected":[{"ecosystem":"Vendor product","name":"amqp091-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"rabbitmq\",\n                    \"product\": \"amqp091-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.13.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":8.9,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-79921","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-79921","identifiers":["CVE-2026-79921"]},"retained":false,"historicalAffected":[]},{"revision":"acf48b922b134677b43b325f9727618f","observedAt":"2026-11-15T17:52:42.307+00:00","statement":{"source":"euvd","id":"EUVD-2026-66715","aliases":["CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"],"title":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to …","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":8.9,"severity":null}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-66715","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 26, 2026, 8:24:58 PM","dateUpdated":"Aug 29, 2026, 2:50:25 AM"},"relatedAdvisories":[{"id":"RHSA-2026:79546","title":"Red Hat Security Advisory: Red Hat Quay 3.12.23","vulnerabilityIds":["CVE-2026-17106","CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-87776","CVE-2026-94603"]},{"id":"RHSA-2026:60854","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-79921"]},{"id":"RHSA-2026:99024","title":"Red Hat Security Advisory: Red Hat Quay - 3.14.10","vulnerabilityIds":["CVE-2026-49825","CVE-2026-54770","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-84292","CVE-2026-84394","CVE-2026-87776","CVE-2026-90711","CVE-2026-93749","CVE-2026-94603","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102268","CVE-2026-102272","CVE-2026-102273","CVE-2026-102994","CVE-2026-102996","CVE-2026-102997","CVE-2026-102998","CVE-2026-102999","CVE-2026-103000","CVE-2026-110697","CVE-2026-112390","CVE-2026-118669","CVE-2026-123710"]},{"id":"RHSA-2026:79366","title":"Red Hat Security Advisory: Red Hat Quay 3.10.27","vulnerabilityIds":["CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-87776"]},{"id":"RHSA-2026:99019","title":"Red Hat Security Advisory: Red Hat Quay - 3.18.3","vulnerabilityIds":["CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-84394","CVE-2026-93749","CVE-2026-94603","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102268","CVE-2026-102272","CVE-2026-102273","CVE-2026-102996","CVE-2026-102997","CVE-2026-102999","CVE-2026-103000","CVE-2026-110642","CVE-2026-110697","CVE-2026-112390","CVE-2026-114613","CVE-2026-118669","CVE-2026-119194","CVE-2026-123710"]},{"id":"RHSA-2026:80217","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","vulnerabilityIds":["CVE-2026-79921","CVE-2026-107386"]},{"id":"RHSA-2026:99023","title":"Red Hat Security Advisory: Red Hat Quay - 3.15.9","vulnerabilityIds":["CVE-2026-15792","CVE-2026-32283","CVE-2026-33818","CVE-2026-39822","CVE-2026-42504","CVE-2026-49825","CVE-2026-54770","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-59879","CVE-2026-67213","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-84375","CVE-2026-93749","CVE-2026-94603","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102268","CVE-2026-102272","CVE-2026-102273","CVE-2026-102994","CVE-2026-102996","CVE-2026-102997","CVE-2026-102998","CVE-2026-102999","CVE-2026-103000","CVE-2026-110697","CVE-2026-112390","CVE-2026-118669","CVE-2026-123710"]},{"id":"RHSA-2026:73038","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:67842","title":"Red Hat Security Advisory: Multicluster Global Hub 1.7.3 security update","vulnerabilityIds":["CVE-2026-32282","CVE-2026-33815","CVE-2026-33818","CVE-2026-34040","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:99022","title":"Red Hat Security Advisory: Red Hat Quay - 3.16.7","vulnerabilityIds":["CVE-2026-49825","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-84292","CVE-2026-84394","CVE-2026-93749","CVE-2026-94603","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102268","CVE-2026-102272","CVE-2026-102273","CVE-2026-102994","CVE-2026-102996","CVE-2026-102997","CVE-2026-102998","CVE-2026-102999","CVE-2026-103000","CVE-2026-110642","CVE-2026-110697","CVE-2026-112390","CVE-2026-118669","CVE-2026-123710"]},{"id":"RHSA-2026:68515","title":"Red Hat Security Advisory: Multicluster Global Hub 1.8.2 security update","vulnerabilityIds":["CVE-2026-17106","CVE-2026-33818","CVE-2026-41178","CVE-2026-42502","CVE-2026-46604","CVE-2026-48586","CVE-2026-50151","CVE-2026-56852","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-71235","CVE-2026-71576","CVE-2026-71577","CVE-2026-75762","CVE-2026-77849","CVE-2026-79921","CVE-2026-80220","CVE-2026-80221"]},{"id":"RHSA-2026:77656","title":"Red Hat Security Advisory: Red Hat Quay 3.9.27","vulnerabilityIds":["CVE-2026-17106","CVE-2026-49825","CVE-2026-54770","CVE-2026-59879","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-82417","CVE-2026-84292","CVE-2026-84394","CVE-2026-87776"]},{"id":"RHSA-2026:99026","title":"Red Hat Security Advisory: Red Hat Quay - 3.17.7","vulnerabilityIds":["CVE-2026-32591","CVE-2026-77403","CVE-2026-77404","CVE-2026-77406","CVE-2026-77409","CVE-2026-77410","CVE-2026-77412","CVE-2026-79921","CVE-2026-84375","CVE-2026-93749","CVE-2026-97687","CVE-2026-97689","CVE-2026-102267","CVE-2026-102268","CVE-2026-102272","CVE-2026-102273","CVE-2026-102996","CVE-2026-102997","CVE-2026-102999","CVE-2026-103000","CVE-2026-110642","CVE-2026-110697","CVE-2026-112390","CVE-2026-118669","CVE-2026-123710"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-66715","identifiers":["EUVD-2026-66715","CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"]},"retained":false,"historicalAffected":[]},{"revision":"fe5505f635dd4ae084060d66813651ba","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-79921","aliases":[],"title":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to …","description":"amqp091-go is a Go AMQP 0.9.1 client. Before version 1.13.0, a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints. Version 1.13.0 contains a fix. No known workarounds are available.","state":0,"publishedAt":"2026-08-26T21:16:41.873+00:00","modifiedAt":"2026-09-09T21:09:13.08+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.9,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0","https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-79921","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-770"],"productCriteria":[],"sourceDates":{"published":"2026-08-26T21:16:41.873","lastModified":"2026-09-09T21:09:13.080"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-79921","identifiers":["CVE-2026-79921"]},"retained":false,"historicalAffected":[]},{"revision":"89c11fbabc1a4b239568f73dac9a8d3b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6c5v-hqjr-5xxp","aliases":["CVE-2026-79921","GO-2026-6372"],"title":"amqp091-go has a Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload","description":"**Summary**\nA vulnerability exists in the amqp091-go client library where a compromised or malicious AMQP broker can force the client to allocate resources for and process content body frames that exceed the negotiated frame_max limit. This can lead to unexpected memory consumption or application-layer denial of service (DoS), bypassing the protocol's built-in framing constraints.\n\n**Details**\nDuring a standard AMQP 0-9-1 connection handshake, the client and the broker negotiate a maximum frame size (frame_max), for example, 4096 bytes.\n\nHowever, after negotiation, a malicious broker can send a valid basic.deliver sequence containing a content body frame whose header declares a payload size larger than the negotiated frame_max. Instead of enforcing the agreed-upon limit and closing the connection with a frame-error (as mandated by the AMQP 0-9-1 specification), the amqp091-go client:\n\n1. Accepts the broker-declared oversized frame size.\n2. Allocates memory based on this oversized declaration.\n3. Reads the payload, assembles it into the message, and delivers it to the consumer.\n\n**Impact**\n\n- Denial of Service (DoS): If a broker sends extremely large frame sizes, it can trigger significant memory allocations on the client side, potentially leading to Out-Of-Memory (OOM) crashes.\n- Protocol Violation: The client fails to enforce negotiated connection parameters, trusting the broker implicitly even after constraints have been established.","state":0,"publishedAt":"2026-09-03T20:15:13+00:00","modifiedAt":"2026-09-15T19:10:48.5771971+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://nvd.nist.gov/vuln/detail/CVE-2026-79921","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://github.com/advisories/GHSA-6c5v-hqjr-5xxp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6c5v-hqjr-5xxp","identifiers":["GHSA-6c5v-hqjr-5xxp","CVE-2026-79921","GO-2026-6372"]},"retained":false,"historicalAffected":[]},{"revision":"2fb135bb294b4fb1b01ccdd2c921c160","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6372","aliases":["CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"],"title":"Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go","description":"Potential Memory Exhaustion/Protocol Violation via Broker-Controlled Oversized Payload in github.com/rabbitmq/amqp091-go","state":0,"publishedAt":"2026-09-15T18:39:25+00:00","modifiedAt":"2026-09-15T19:00:17.0151357+00:00","affected":[{"ecosystem":"Go","name":"github.com/rabbitmq/amqp091-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.13.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-6c5v-hqjr-5xxp","https://github.com/rabbitmq/amqp091-go/commit/6beb7b51f59e46ddcf8066ad498dad32491d3be0","https://github.com/rabbitmq/amqp091-go/pull/353","https://github.com/rabbitmq/amqp091-go/releases/tag/v1.13.0"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6372","license":"OSV · upstream source license applies","key":"osv:GO-2026-6372","identifiers":["GO-2026-6372","CVE-2026-79921","GHSA-6c5v-hqjr-5xxp"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9319367+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9319376+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-85332baa2a2fe51044c7b11e74168cdf9ea3251563b394940fa4249a4ab5eea5","complete":true,"records":425838,"lastAttemptAt":"2026-11-15T17:43:56.7045831+00:00","lastSuccessAt":"2026-11-15T17:43:56.6887608+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:56.7045831+00:00","snapshotPublishedAt":"2026-11-15T17:26:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b236bb13999347ce987e1ca186c5d1f1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T17:54:40.0701718+00:00","lastSuccessAt":"2026-11-15T17:54:40.063+00:00","error":"54 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T17:54:40.063+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13820,"expectedIdentifiers":13874,"failedIdentifiers":54},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9327717+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9327718+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31b467d979fb43bea77e4ea73320cf71","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T17:44:08.5219832+00:00","lastSuccessAt":"2026-11-15T17:44:08.513+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:44:08.513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T17:43:57.6786653+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6786653+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T17:43:57.373573+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.373573+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T17:43:57.6970901+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6970901+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T17:43:57.5611113+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.5611113+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}