{"id":"GHSA-f2g3-hh2r-cwgc","revision":null,"records":[{"revision":"b1b649e986e54496a77629fa3e6e39d1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-35172","aliases":[],"title":"Distribution has stale blob access resurrection via repo-scoped redis descriptor cache invalidation","description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":"2026-04-06T19:08:44.512+00:00","modifiedAt":"2026-09-09T12:04:57.565+00:00","affected":[{"ecosystem":"Vendor product","name":"distribution","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"distribution\",\n                    \"product\": \"distribution\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.1.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-35172","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-35172","identifiers":["CVE-2026-35172"]},"retained":false,"historicalAffected":[]},{"revision":"6b5c638758f44cc8afefc69af99b1e58","observedAt":"2026-11-15T12:08:16.687+00:00","statement":{"source":"euvd","id":"EUVD-2026-19446","aliases":["CVE-2026-35172"],"title":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true…","description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":null}],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-19446","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 6, 2026, 7:08:44 PM","dateUpdated":"Sep 9, 2026, 12:04:57 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-2072","title":"Red Hat OpenShift: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-1784","CVE-2026-35172"]},{"id":"SUSE-SU-2026:21560-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-33186","CVE-2026-33540","CVE-2026-34986","CVE-2026-35172"]},{"id":"RHSA-2026:26529","title":"Red Hat Security Advisory: OpenShift Container Platform 4.12.92 bug fix and security update","vulnerabilityIds":["CVE-2026-35172"]},{"id":"openSUSE-SU-2026:10631-1","title":"distribution-registry-3.1.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-33186","CVE-2026-33540","CVE-2026-34986","CVE-2026-35172"]},{"id":"RHSA-2026:28893","title":"Red Hat Security Advisory: OpenShift Container Platform 4.14.68 bug fix and security update","vulnerabilityIds":["CVE-2025-68121","CVE-2026-1784","CVE-2026-25679","CVE-2026-27143","CVE-2026-27144","CVE-2026-29063","CVE-2026-33186","CVE-2026-35172"]},{"id":"RHSA-2026:26543","title":"Red Hat Security Advisory: OpenShift Container Platform 4.13.68 bug fix and security update","vulnerabilityIds":["CVE-2026-1784","CVE-2026-35172"]},{"id":"RHSA-2026:25045","title":"Red Hat Security Advisory: OpenShift Container Platform 4.16.64 bug fix and security update","vulnerabilityIds":["CVE-2026-1784","CVE-2026-33186","CVE-2026-35172"]},{"id":"RHSA-2026:23234","title":"Red Hat Security Advisory: OpenShift Container Platform 4.15.65 bug fix and security update","vulnerabilityIds":["CVE-2026-33186","CVE-2026-35172"]},{"id":"openSUSE-SU-2026:20686-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-33186","CVE-2026-33540","CVE-2026-34986","CVE-2026-35172"]},{"id":"RHSA-2026:37387","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.0 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2024-25621","CVE-2024-40635","CVE-2024-45310","CVE-2025-8766","CVE-2025-21613","CVE-2025-21614","CVE-2025-22870","CVE-2025-47911","CVE-2025-52881","CVE-2025-54410","CVE-2025-58058","CVE-2025-64329","CVE-2025-66506","CVE-2026-22772","CVE-2026-23831","CVE-2026-24117","CVE-2026-25680","CVE-2026-25681","CVE-2026-25934","CVE-2026-27136","CVE-2026-27141","CVE-2026-27903","CVE-2026-33540","CVE-2026-33747","CVE-2026-33748","CVE-2026-33814","CVE-2026-34986","CVE-2026-35172","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-39883","CVE-2026-41506","CVE-2026-41567","CVE-2026-41568","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-44740","CVE-2026-45571","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-19446","identifiers":["EUVD-2026-19446","CVE-2026-35172"]},"retained":false,"historicalAffected":[]},{"revision":"d1143a5b53cb4e2d9fc6d04cf7b05075","observedAt":"2026-10-25T08:17:35.884+00:00","statement":{"source":"nvd","id":"CVE-2026-35172","aliases":[],"title":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true…","description":"Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.0, distribution can restore read access in repo a after an explicit delete when storage.cache.blobdescriptor: redis and storage.delete.enabled: true are both enabled. The delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later Stat or Get from repo b repopulates the shared descriptor and makes the deleted blob readable from repo a again. This vulnerability is fixed in 3.1.0.","state":0,"publishedAt":"2026-04-06T20:16:25.607+00:00","modifiedAt":"2026-09-09T13:19:39.007+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5,"severity":"HIGH"}],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc","https://access.redhat.com/errata/RHSA-2026:23234","https://access.redhat.com/errata/RHSA-2026:25045","https://access.redhat.com/errata/RHSA-2026:26529","https://access.redhat.com/errata/RHSA-2026:26543","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/security/cve/CVE-2026-35172","https://bugzilla.redhat.com/show_bug.cgi?id=2455571","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-35172.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-35172","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-284","NVD-CWE-noinfo","CWE-524"],"productCriteria":["cpe:2.3:a:distribution:distribution:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-04-06T20:16:25.607","lastModified":"2026-09-09T13:19:39.007"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-35172","identifiers":["CVE-2026-35172"]},"retained":false,"historicalAffected":[]},{"revision":"e0ebe159235b49bbb66e6e5f7dc66ff5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-f2g3-hh2r-cwgc","aliases":["BIT-distribution-2026-35172","CVE-2026-35172","GO-2026-4942"],"title":"Distribution: stale blob access resurrection via repo-scoped redis descriptor cache invalidation","description":"## summary:\ndistribution can restore read access in `repo a` after an explicit delete when `storage.cache.blobdescriptor: redis` and `storage.delete.enabled: true` are both enabled. the delete path clears the shared digest descriptor but leaves stale repo-scoped membership behind, so a later `Stat` or `Get` from `repo b` repopulates the shared descriptor and makes the deleted blob readable from `repo a` again.\n\n## Severity\n\nHIGH\n\njustification: this is a repo-local authorization bypass after explicit delete, with concrete confidentiality impact and no requirement for write access after the delete event. CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5). CWE-284.\n\n# affected version\n\n- repository: https://github.com/distribution/distribution\n- commit: ab67ffa0bda3712991194841d0fde727464feeb9\n- affected versions: \\<= 3.0.x, \\<= 2.8.x when redis blob descriptor cache and delete are both enabled\n- affected file:\n  - https://github.com/distribution/distribution/blob/ab67ffa0bda3712991194841d0fde727464feeb9/registry/storage/cache/redis/redis.go#L212-L226\n- related callsites:\n  - https://github.com/distribution/distribution/blob/ab67ffa0bda3712991194841d0fde727464feeb9/registry/storage/cache/cachedblobdescriptorstore.go#L66-L76\n  - https://github.com/distribution/distribution/blob/ab67ffa0bda3712991194841d0fde727464feeb9/registry/storage/linkedblobstore.go#L218-L224\n  - https://github.com/distribution/distribution/blob/ab67ffa0bda3712991194841d0fde727464feeb9/registry/storage/linkedblobstore.go#L396-L403\n\n# details\n\nthe backend access model is repository-link based: once `repo a` deletes its blob link, later reads from `repo a` should continue returning `ErrBlobUnknown` even if the same digest remains linked in `repo b`.\n\nthe issue is the split invalidation path in the redis cache backend:\n\n1. `linkedBlobStore.Delete` calls `blobAccessController.Clear` during repository delete handling.\n2. `cachedBlobStatter.Clear` forwards that invalidation into the cache layer.\n3. `repositoryScopedRedisBlobDescriptorService.Clear` checks that the digest is a member of `repo a`, but then only calls `upstream.Clear`.\n4. `upstream.Clear` deletes the shared digest descriptor and does not remove the digest from the repository membership set for `repo a`.\n5. when `repo b` later stats or gets the same digest, the shared descriptor is recreated.\n6. `repositoryScopedRedisBlobDescriptorService.Stat` for `repo a` accepts the stale membership and now trusts the repopulated shared descriptor, restoring access in the repository that already deleted its link.\n\nthis creates a revocation gap at the repository boundary. the blob is briefly inaccessible from `repo a` right after delete, which confirms the backend link was removed, and then becomes accessible again only because stale redis membership survived while a peer repository repopulated the shared descriptor.\n\n# attack scenario\n\n1. an operator runs distribution with `storage.cache.blobdescriptor: redis` and `storage.delete.enabled: true`.\n2. the same digest exists in both `repo a` and `repo b`.\n3. the operator deletes the blob from `repo a` and expects repository-local access to be revoked.\n4. `repo a` correctly returns `blob unknown` immediately after the delete.\n5. an anonymous or unprivileged user requests the same digest from `repo b`, which still legitimately owns it and repopulates the shared descriptor.\n6. a later request for the digest from `repo a` succeeds again because stale repo-a membership was never revoked from redis.\n\n# PoC\n\nattachment: `poc.zip`\n\nthe attached PoC is a deterministic integration harness using `miniredis` and the pinned distribution source tree.\n\n## steps to reproduce\n\ncanonical:\n\n```bash\nunzip -q -o poc.zip -d poc\ncd poc\nmake canonical\n```\n\nexpected output:\n\n```text\n[CALLSITE_HIT]: repositoryScopedRedisBlobDescriptorService.Clear->upstream.Clear->repositoryScopedRedisBlobDescriptorService.Stat\n[PROOF_MARKER]: repo_a_access_restored=true repo_a_delete_miss=true repo_b_peer_warm=true\n[IMPACT_MARKER]: repo_a_post_delete_read=true confidentiality_boundary_broken=true\n```\n\ncontrol:\n\n```bash\nunzip -q -o poc.zip -d poc\ncd poc\nmake control\n```\n\nexpected control output:\n\n```text\n[CALLSITE_HIT]: repositoryScopedRedisBlobDescriptorService.Clear->repositoryScopedRedisBlobDescriptorService.Stat\n[NC_MARKER]: repo_a_access_restored=false repo_b_peer_warm=true\n```\n\n# expected vs actual\n\n- expected: after `repo a` deletes its blob link, later reads from `repo a` should keep returning `blob unknown` even if `repo b` still references the same digest and warms cache state.\n- actual: `repo a` first returns `blob unknown`, then `repo b` repopulates the shared descriptor, and `repo a` serves the deleted digest again through stale repo-scoped redis membership.\n\n# impact\n\nthe confirmed impact is repository-local confidentiality failure after explicit delete. an operator can remove sensitive content from `repo a`, observe revocation working immediately after the delete, and still have the same content become readable from `repo a` again as soon as `repo b` refreshes the shared descriptor for that digest.\n\nthis is not a claim about global blob deletion. the bounded claim is that repository-local revocation fails, which breaks the expectation that deleting a blob link from one repository prevents further reads from that repository.\n\n# remediation\n\nthe safest fix is to make redis invalidation revoke repo-scoped state together with the backend link deletion. in practice that means removing the digest from the repository membership set, deleting the repo-scoped descriptor hash, and keeping that cleanup atomic enough that peer-repository warming cannot restore access in the repository that already deleted its link.\n\n[poc.zip](https://github.com/user-attachments/files/25813827/poc.zip)\n[PR_DESCRIPTION.md](https://github.com/user-attachments/files/25813828/PR_DESCRIPTION.md)\n[attack_scenario.md](https://github.com/user-attachments/files/25813829/attack_scenario.md)","state":0,"publishedAt":"2026-04-06T17:53:40+00:00","modifiedAt":"2026-09-10T03:51:01.5600911+00:00","affected":[{"ecosystem":"Go","name":"github.com/distribution/distribution/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/distribution/distribution","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"2.8.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc","https://nvd.nist.gov/vuln/detail/CVE-2026-35172","https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d","https://github.com/distribution/distribution"],"sourceUrl":"https://github.com/advisories/GHSA-f2g3-hh2r-cwgc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f2g3-hh2r-cwgc","identifiers":["GHSA-f2g3-hh2r-cwgc","BIT-distribution-2026-35172","CVE-2026-35172","GO-2026-4942"]},"retained":false,"historicalAffected":[]},{"revision":"336f16f51c0c4923a73f66c2b8bb10dd","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-4942","aliases":["BIT-distribution-2026-35172","CVE-2026-35172","GHSA-f2g3-hh2r-cwgc"],"title":"Stale blob descriptor cache invalidation in github.com/distribution/distribution","description":"In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.","state":0,"publishedAt":"2026-08-18T18:05:09+00:00","modifiedAt":"2026-08-18T21:40:42.9348609+00:00","affected":[{"ecosystem":"Go","name":"github.com/distribution/distribution","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/distribution/distribution/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc","https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d","https://github.com/golang/vulndb/issues/4942"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-4942","license":"OSV · upstream source license applies","key":"osv:GO-2026-4942","identifiers":["GO-2026-4942","BIT-distribution-2026-35172","CVE-2026-35172","GHSA-f2g3-hh2r-cwgc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}