{"matches":[{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00312,"percentile":0.22681,"date":"2026-10-20"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.17939999999999998},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"fef07e9c95ea2bda","name":"busybox","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:28ea46474b3da85dab8e4e50d6f73e04bca24baee733ec25941c557dee337ab3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}],"Arch":"x86_64"}}},{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00312,"percentile":0.22681,"date":"2026-10-20"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.17939999999999998},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"915155597fcdee9a","name":"busybox-binsh","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:28ea46474b3da85dab8e4e50d6f73e04bca24baee733ec25941c557dee337ab3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/bin"},{"path":"/bin/sh"}],"Arch":"x86_64"}}},{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00312,"percentile":0.22681,"date":"2026-10-20"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.17939999999999998},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"8a9ef44e1018f213","name":"ssl_client","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:28ea46474b3da85dab8e4e50d6f73e04bca24baee733ec25941c557dee337ab3","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}],"Arch":"x86_64"}}}],"source":{"type":"image","target":{"userInput":"build/payload/haproxy-3.4.7-alpine-tpio.1","imageID":"sha256:f6976bb02e3beaeb7cc64cedcd087d9823dde654c5df86055a98ab27cfa6ce07","manifestDigest":"sha256:5c14f9a8b26004f13288ddb97ff7b9380a63f7513c89afc0db19b3c4df4db65a","mediaType":"application/vnd.oci.image.manifest.v1+json","tags":[],"imageSize":51134209,"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:74d97c428c51a828f9051a7a40a53ff1fc99e54fc30323ce36760701b0b7f711","size":8417144},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:3e8b38d0719d973720c67725829de69f9c45de709cf78925a10cfd5b00527069","size":1718970},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:9ec640061524662f440807d2d24bc3a9416dba5f079f29fc692fb24519dad532","size":3056},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:9f45ae2b002a3269d94019ec409c4094cc2675c6618953993aef4f278814aa0d","size":39838696},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:0408c00aedaf1d20aa4bac11fbf83ace2c481692c5b389ca397c0b427c369aa2","size":417},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:5f70bf18a086007016e948b04aed3b82103a36bea41755b6cddfaf10ace3c6ef","size":0},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:28ea46474b3da85dab8e4e50d6f73e04bca24baee733ec25941c557dee337ab3","size":1155926}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLm1hbmlmZXN0LnYxK2pzb24iLCJjb25maWciOnsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsImRpZ2VzdCI6InNoYTI1NjpmNjk3NmJiMDJlM2JlYWViN2NjNjRjZWRjZDA4N2Q5ODIzZGRlNjU0YzVkZjg2MDU1YTk4YWIyN2NmYTZjZTA3Iiwic2l6ZSI6NjUxNX0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo0ZmRjNTZhMWQ0OWZjNzQ5ZjRiNmQ1M2U0NjhhMDQ2Y2QxYTAxOWU3YjEwOGIxZTVjOTU0YTQzNTQ4ZTM5OTdkIiwic2l6ZSI6Mzk2OTk2N30seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OmE5N2YxNDA1Nzk0ZWQwODBhMmE1NmM5ZDBmNWFmYjQwMzY4YWE5MWUxYmViNGQ5YmYwN2Q0MjcyZTI1YmMyYWYiLCJzaXplIjo4MDY4MDR9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo2MWVjY2E2YWVhNWIxMmY3ZGQxMGIyOTc0ZGZjMjlhNGY4MWRlNzEwZjQ5NTQ3OGViNjgzMGY1NzBhMGUwN2IyIiwic2l6ZSI6OTgxfSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6Zjc0ZGQ2NWU1OTlhYjJiMmU0YWZmNmRkNTdhN2ZkMmM2M2UxYmE5YzQ4NTIwNjViM2VlYzY3YzcxZGQ1NTc0MyIsInNpemUiOjE4ODg5Njc2fSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6ZTA1Y2E5NTc5YmRkMmRjNTk5MmE1YTgxZjgwMGVhMzE4MzQwMDZlMDFhNGFhZTAyMjJhNDQzODBiZDY4MTUzMCIsInNpemUiOjQ0OH0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OmJkOWRkYzU0YmVhOTI5YTIyYjMzNGU3M2UwMjZkNDEzNmU1YjczZjVjYzI5OTQyODk2YzcyZTRlY2U2OWIxM2QiLCJzaXplIjozNH0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OjJmYTQxZjNiZmFhOTBhNTI4ZmE3MDE3NGNjYWUwNzk4NzdkNmU0NjgyYmRmM2M5ZDQ5Y2M5NzQ1NmU2YmM2NTQiLCJzaXplIjo2OTMwODl9XSwiYW5ub3RhdGlvbnMiOnsiY29tLmRvY2tlci5vZmZpY2lhbC1pbWFnZXMuYmFzaGJyZXcuYXJjaCI6ImFtZDY0Iiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmJhc2UuZGlnZXN0Ijoic2hhMjU2OmMyYzY4MjRiZDliZjliNGMxZGQyODg2NGEzMTEwYjM3Nzc0YjI4NTY2YzJlNGEzNGJjMGVlZDE2ZDE4ZDMyOWEiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuYmFzZS5uYW1lIjoiZWNyLXB1YmxpYy5hd3MuY29tL2RvY2tlci9saWJyYXJ5L2hhcHJveHlAc2hhMjU2OjI1MWRhNjk4MjE4OTdlYzhjNDgxOWYxMmIxYmFiYmM0YjcxZjU2Mjk0M2FkZGM5YjllYjE0YmI2ZWNlNDBkYzYiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuY3JlYXRlZCI6IjIwMjYtMTAtMjFUMTg6NTE6NTYuNjgzOTM2NThaIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnJldmlzaW9uIjoiNGU3MTM3ZjI0YzVhY2Q1NmIyMWFkYzAxYTZjOTkzZTM2ZGM5ZGNkMCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5zb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vZG9ja2VyLWxpYnJhcnkvaGFwcm94eS5naXQjNGU3MTM3ZjI0YzVhY2Q1NmIyMWFkYzAxYTZjOTkzZTM2ZGM5ZGNkMDozLjQvYWxwaW5lIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybCI6Imh0dHBzOi8vaHViLmRvY2tlci5jb20vXy9oYXByb3h5Iiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb24iOiIzLjQuNy1hbHBpbmUifX0=","config":"eyJjcmVhdGVkIjoiMjAyNi0xMC0yMVQxODo1MTo1Ni42ODM5MzY1OFoiLCJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsIm9zIjoibGludXgiLCJjb25maWciOnsiVXNlciI6ImhhcHJveHkiLCJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iLCJIQVBST1hZX1ZFUlNJT049My40LjciLCJIQVBST1hZX1VSTD1odHRwczovL3d3dy5oYXByb3h5Lm9yZy9kb3dubG9hZC8zLjQvc3JjL2hhcHJveHktMy40LjcudGFyLmd6IiwiSEFQUk9YWV9TSEEyNTY9Y2NmZDM0MmYzNzI0YzJjZDY1OTU3NDA0NGQ3ODhmNDRlMjBiMjEyNDY3YzZiZDVlZGJiZmM1MTdhMjc3NWRjYSJdLCJFbnRyeXBvaW50IjpbImRvY2tlci1lbnRyeXBvaW50LnNoIl0sIkNtZCI6WyJoYXByb3h5IiwiLWYiLCIvdXNyL2xvY2FsL2V0Yy9oYXByb3h5L2hhcHJveHkuY2ZnIl0sIldvcmtpbmdEaXIiOiIvdmFyL2xpYi9oYXByb3h5IiwiTGFiZWxzIjp7ImlvLmJ1aWxkYWgudmVyc2lvbiI6IjEuNDMuMSIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQuY2xhaW0iOiJwYWNrYWdlLWZpeGFibGUgQ1JJVElDQUwvSElHSCBjbGVhcmVkIHZzIHVwc3RyZWFtIGRpZ2VzdDsgbm90IEZJUFMvRmVkUkFNUCIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQubGFkZGVyIjoiYStjIiwiaW8udGhlcGVvcGxlcy5oYXJkZW5lZC5yZXBsYWNlcyI6ImVjci1wdWJsaWMuYXdzLmNvbS9kb2NrZXIvbGlicmFyeS9oYXByb3h5OjMuMy4xMC1hbHBpbmVAc2hhMjU2OjI5Yzc3NWY1NDFiYTYzNjRhYzk1ZGU5OThhOGQzZDE2ZWI0ODgyNDcwYzRmZDdiYmU4ZGU4MzE1ZWRmZGQ4ODMiLCJpby50aGVwZW9wbGVzLmhhcmRlbmVkLnVwc3RyZWFtIjoiZWNyLXB1YmxpYy5hd3MuY29tL2RvY2tlci9saWJyYXJ5L2hhcHJveHk6My40LjctYWxwaW5lQHNoYTI1NjoyNTFkYTY5ODIxODk3ZWM4YzQ4MTlmMTJiMWJhYmJjNGI3MWY1NjI5NDNhZGRjOWI5ZWIxNGJiNmVjZTQwZGM2Iiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb24iOiIzLjQuNy1hbHBpbmUifSwiU3RvcFNpZ25hbCI6IlNJR1VTUjEifSwicm9vdGZzIjp7InR5cGUiOiJsYXllcnMiLCJkaWZmX2lkcyI6WyJzaGEyNTY6NzRkOTdjNDI4YzUxYTgyOGY5MDUxYTdhNDBhNTNmZjFmYzk5ZTU0ZmMzMDMyM2NlMzY3NjA3MDFiMGI3ZjcxMSIsInNoYTI1NjozZThiMzhkMDcxOWQ5NzM3MjBjNjc3MjU4MjlkZTY5ZjljNDVkZTcwOWNmNzg5MjVhMTBjZmQ1YjAwNTI3MDY5Iiwic2hhMjU2OjllYzY0MDA2MTUyNDY2MmY0NDA4MDdkMmQyNGJjM2E5NDE2ZGJhNWYwNzlmMjlmYzY5MmZiMjQ1MTlkYWQ1MzIiLCJzaGEyNTY6OWY0NWFlMmIwMDJhMzI2OWQ5NDAxOWVjNDA5YzQwOTRjYzI2NzVjNjYxODk1Mzk5M2FlZjRmMjc4ODE0YWEwZCIsInNoYTI1NjowNDA4YzAwYWVkYWYxZDIwYWE0YmFjMTFmYmY4M2FjZTJjNDgxNjkyYzViMzg5Y2EzOTdjMGI0MjdjMzY5YWEyIiwic2hhMjU2OjVmNzBiZjE4YTA4NjAwNzAxNmU5NDhiMDRhZWQzYjgyMTAzYTM2YmVhNDE3NTViNmNkZGZhZjEwYWNlM2M2ZWYiLCJzaGEyNTY6MjhlYTQ2NDc0YjNkYTg1ZGFiOGU0ZTUwZDZmNzNlMDRiY2EyNGJhZWU3MzNlYzI1OTQxYzU1N2RlZTMzN2FiMyJdfSwiaGlzdG9yeSI6W3siY3JlYXRlZCI6IjIwMjYtMDktMTdUMjA6Mzc6MjAuODg5MjIxODc5WiIsImNyZWF0ZWRfYnkiOiJBREQgYWxwaW5lLW1pbmlyb290ZnMtMy4yNC4yLXg4Nl82NC50YXIuZ3ogLyAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifSx7ImNyZWF0ZWQiOiIyMDI2LTA5LTE3VDIwOjM3OjIwLjg4OTIyMTg3OVoiLCJjcmVhdGVkX2J5IjoiQ01EIFtcIi9iaW4vc2hcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTE0VDIwOjE2OjU1LjA5OTg2NzEyNloiLCJjcmVhdGVkX2J5IjoiUlVOIC9iaW4vc2ggLWMgc2V0IC1ldXg7IFx0YXBrIGFkZCAtLW5vLWNhY2hlIFx0XHRjYS1jZXJ0aWZpY2F0ZXMgXHRcdHNvY2F0IFx0OyAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTE0VDIwOjE2OjU1LjIzNTkwMjZaIiwiY3JlYXRlZF9ieSI6IlJVTiAvYmluL3NoIC1jIHNldCAtZXV4OyBcdGFkZGdyb3VwIC0tZ2lkIDk5IC0tc3lzdGVtIGhhcHJveHk7IFx0YWRkdXNlciBcdFx0LS1kaXNhYmxlZC1wYXNzd29yZCBcdFx0LS1ob21lIC92YXIvbGliL2hhcHJveHkgXHRcdC0taW5ncm91cCBoYXByb3h5IFx0XHQtLW5vLWNyZWF0ZS1ob21lIFx0XHQtLXN5c3RlbSBcdFx0LS11aWQgOTkgXHRcdGhhcHJveHkgXHQ7IFx0bWtkaXIgL3Zhci9saWIvaGFwcm94eTsgXHRjaG93biBoYXByb3h5OmhhcHJveHkgL3Zhci9saWIvaGFwcm94eSAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTE0VDIwOjE3OjQwLjM3ODA4OTQ5M1oiLCJjcmVhdGVkX2J5IjoiRU5WIEhBUFJPWFlfVkVSU0lPTj0zLjQuNyIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTRUMjA6MTc6NDAuMzc4MDg5NDkzWiIsImNyZWF0ZWRfYnkiOiJFTlYgSEFQUk9YWV9VUkw9aHR0cHM6Ly93d3cuaGFwcm94eS5vcmcvZG93bmxvYWQvMy40L3NyYy9oYXByb3h5LTMuNC43LnRhci5neiIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTRUMjA6MTc6NDAuMzc4MDg5NDkzWiIsImNyZWF0ZWRfYnkiOiJFTlYgSEFQUk9YWV9TSEEyNTY9Y2NmZDM0MmYzNzI0YzJjZDY1OTU3NDA0NGQ3ODhmNDRlMjBiMjEyNDY3YzZiZDVlZGJiZmM1MTdhMjc3NWRjYSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTRUMjA6MTc6NDAuMzc4MDg5NDkzWiIsImNyZWF0ZWRfYnkiOiJSVU4gL2Jpbi9zaCAtYyBzZXQgLWV1eDsgXHRcdGFwayBhZGQgLS1uby1jYWNoZSAtLXZpcnR1YWwgLmJ1aWxkLWRlcHMgXHRcdGdjYyBcdFx0bGliYy1kZXYgXHRcdGxpbnV4LWhlYWRlcnMgXHRcdGx1YTUuNC1kZXYgXHRcdG1ha2UgXHRcdG9wZW5zc2wgXHRcdG9wZW5zc2wtZGV2IFx0XHRwY3JlMi1kZXYgXHRcdHJlYWRsaW5lLWRldiBcdFx0dGFyIFx0OyBcdFx0d2dldCAtTyBoYXByb3h5LnRhci5neiBcIiRIQVBST1hZX1VSTFwiOyBcdGVjaG8gXCIkSEFQUk9YWV9TSEEyNTYgKmhhcHJveHkudGFyLmd6XCIgfCBzaGEyNTZzdW0gLWM7IFx0bWtkaXIgLXAgL3Vzci9zcmMvaGFwcm94eTsgXHR0YXIgLXh6ZiBoYXByb3h5LnRhci5neiAtQyAvdXNyL3NyYy9oYXByb3h5IC0tc3RyaXAtY29tcG9uZW50cz0xOyBcdHJtIGhhcHJveHkudGFyLmd6OyBcdFx0bWFrZU9wdHM9JyBcdFx0VEFSR0VUPWxpbnV4LW11c2wgXHRcdFVTRV9HRVRBRERSSU5GTz0xIFx0XHRVU0VfTFVBPTEgTFVBX0lOQz0vdXNyL2luY2x1ZGUvbHVhNS40IExVQV9MSUI9L3Vzci9saWIvbHVhNS40IFx0XHRVU0VfT1BFTlNTTD0xIFx0XHRVU0VfUENSRTI9MSBVU0VfUENSRTJfSklUPTEgXHRcdFVTRV9QUk9NRVg9MSBcdFx0VVNFX1BUSFJFQURfRU1VTEFUSU9OPTEgXHRcdFVTRV9RVUlDPTEgXHQnOyBcdFx0bnByb2M9XCIkKGdldGNvbmYgX05QUk9DRVNTT1JTX09OTE4pXCI7IFx0ZXZhbCBcIm1ha2UgLUMgL3Vzci9zcmMvaGFwcm94eSAtaiAnJG5wcm9jJyBhbGwgJG1ha2VPcHRzXCI7IFx0ZXZhbCBcIm1ha2UgLUMgL3Vzci9zcmMvaGFwcm94eSBpbnN0YWxsLWJpbiAkbWFrZU9wdHNcIjsgXHRcdG1rZGlyIC1wIC91c3IvbG9jYWwvZXRjL2hhcHJveHk7IFx0Y3AgLVIgL3Vzci9zcmMvaGFwcm94eS9leGFtcGxlcy9lcnJvcmZpbGVzIC91c3IvbG9jYWwvZXRjL2hhcHJveHkvZXJyb3JzOyBcdHJtIC1yZiAvdXNyL3NyYy9oYXByb3h5OyBcdFx0cnVuRGVwcz1cIiQoIFx0XHRzY2FuZWxmIC0tbmVlZGVkIC0tbm9iYW5uZXIgLS1mb3JtYXQgJyVuI3AnIC0tcmVjdXJzaXZlIC91c3IvbG9jYWwgXHRcdFx0fCB0ciAnLCcgJ1xcbicgXHRcdFx0fCBzb3J0IC11IFx0XHRcdHwgYXdrICdzeXN0ZW0oXCJbIC1lIC91c3IvbG9jYWwvbGliL1wiICQxIFwiIF1cIikgPT0gMCB7IG5leHQgfSB7IHByaW50IFwic286XCIgJDEgfScgXHQpXCI7IFx0YXBrIGFkZCAtLW5vLW5ldHdvcmsgLS12aXJ0dWFsIC5oYXByb3h5LXJ1bmRlcHMgJHJ1bkRlcHM7IFx0YXBrIGRlbCAtLW5vLW5ldHdvcmsgLmJ1aWxkLWRlcHM7IFx0XHRoYXByb3h5IC12ICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTRUMjA6MTc6NDAuMzc4MDg5NDkzWiIsImNyZWF0ZWRfYnkiOiJTVE9QU0lHTkFMIFNJR1VTUjEiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTE0VDIwOjE3OjQwLjQyODk0MzE2NVoiLCJjcmVhdGVkX2J5IjoiQ09QWSBkb2NrZXItZW50cnlwb2ludC5zaCAvdXNyL2xvY2FsL2Jpbi8gIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0xNFQyMDoxNzo0MC40Mjg5NDMxNjVaIiwiY3JlYXRlZF9ieSI6IkVOVFJZUE9JTlQgW1wiZG9ja2VyLWVudHJ5cG9pbnQuc2hcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTE0VDIwOjE3OjQwLjQyODk0MzE2NVoiLCJjcmVhdGVkX2J5IjoiVVNFUiBoYXByb3h5IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNi0xMC0xNFQyMDoxNzo0MC40OTc3NTc3NDJaIiwiY3JlYXRlZF9ieSI6IldPUktESVIgL3Zhci9saWIvaGFwcm94eSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0xNFQyMDoxNzo0MC40OTc3NTc3NDJaIiwiY3JlYXRlZF9ieSI6IkNNRCBbXCJoYXByb3h5XCIgXCItZlwiIFwiL3Vzci9sb2NhbC9ldGMvaGFwcm94eS9oYXByb3h5LmNmZ1wiXSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMjFUMTg6NTE6NTMuNzYzMTk0MjU3WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBVU0VSIHJvb3QiLCJjb21tZW50IjoiRlJPTSBlY3ItcHVibGljLmF3cy5jb20vZG9ja2VyL2xpYnJhcnkvaGFwcm94eUBzaGEyNTY6MjUxZGE2OTgyMTg5N2VjOGM0ODE5ZjEyYjFiYWJiYzRiNzFmNTYyOTQzYWRkYzliOWViMTRiYjZlY2U0MGRjNiIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTIxVDE4OjUxOjU2LjAwMTA5MTYzNVoiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyBhcGsgdXBncmFkZSAtLW5vLWNhY2hlIC0tYXZhaWxhYmxlIFx1MDAyNlx1MDAyNiBybSAtcmYgL3Zhci9jYWNoZS9hcGsvKiBcdTAwMjZcdTAwMjYgYXBrIGxpc3QgLS1pbnN0YWxsZWQgXHUwMDNlIC9ldGMvdHAtaGFyZGVuZWQuYXBrLW1hbmlmZXN0In0seyJjcmVhdGVkIjoiMjAyNi0xMC0yMVQxODo1MTo1Ni40MjExODcwMjlaIiwiY3JlYXRlZF9ieSI6Ii9iaW4vc2ggLWMgIyhub3ApIFVTRVIgaGFwcm94eSIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTIxVDE4OjUxOjU2LjY4NDE2NzcwN1oiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249XCIzLjQuNy1hbHBpbmVcIiAgICAgICBpby50aGVwZW9wbGVzLmhhcmRlbmVkLnVwc3RyZWFtPVwiZWNyLXB1YmxpYy5hd3MuY29tL2RvY2tlci9saWJyYXJ5L2hhcHJveHk6My40LjctYWxwaW5lQHNoYTI1NjoyNTFkYTY5ODIxODk3ZWM4YzQ4MTlmMTJiMWJhYmJjNGI3MWY1NjI5NDNhZGRjOWI5ZWIxNGJiNmVjZTQwZGM2XCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC5yZXBsYWNlcz1cImVjci1wdWJsaWMuYXdzLmNvbS9kb2NrZXIvbGlicmFyeS9oYXByb3h5OjMuMy4xMC1hbHBpbmVAc2hhMjU2OjI5Yzc3NWY1NDFiYTYzNjRhYzk1ZGU5OThhOGQzZDE2ZWI0ODgyNDcwYzRmZDdiYmU4ZGU4MzE1ZWRmZGQ4ODNcIiAgICAgICBpby50aGVwZW9wbGVzLmhhcmRlbmVkLmxhZGRlcj1cImErY1wiICAgICAgIGlvLnRoZXBlb3BsZXMuaGFyZGVuZWQuY2xhaW09XCJwYWNrYWdlLWZpeGFibGUgQ1JJVElDQUwvSElHSCBjbGVhcmVkIHZzIHVwc3RyZWFtIGRpZ2VzdDsgbm90IEZJUFMvRmVkUkFNUFwiIiwiZW1wdHlfbGF5ZXIiOnRydWV9XX0=","repoDigests":[],"architecture":"amd64","os":"linux","labels":{"io.buildah.version":"1.43.1","io.thepeoples.hardened.claim":"package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP","io.thepeoples.hardened.ladder":"a+c","io.thepeoples.hardened.replaces":"ecr-public.aws.com/docker/library/haproxy:3.3.10-alpine@sha256:29c775f541ba6364ac95de998a8d3d16eb4882470c4fd7bbe8de8315edfdd883","io.thepeoples.hardened.upstream":"ecr-public.aws.com/docker/library/haproxy:3.4.7-alpine@sha256:251da69821897ec8c4819f12b1babbc4b71f562943addc9b9eb14bb6ece40dc6","org.opencontainers.image.version":"3.4.7-alpine"}}},"distro":{"name":"alpine","version":"3.24.2","idLike":[]},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"linux/amd64","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/tmp/hardened-scanner-session.XM8Ssj/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-21T00:28:41Z_1792564262.tar.zst?checksum=sha256%3Afe51ed05fd0bf2e0642a362b75b245caf0da0eabb92b26a543e061f9873ec2ba","built":"2026-10-21T06:31:02Z","path":"/tmp/hardened-scanner-session.XM8Ssj/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-21T00:28:53Z","input":"xxh64:b6de15d916f3eb2e"},"alpine":{"captured":"2026-10-21T00:29:12Z","input":"xxh64:e20e4d05e5e18322"},"amazon":{"captured":"2026-10-21T00:29:02Z","input":"xxh64:a8ba9496c61bfc2a"},"arch":{"captured":"2026-10-21T00:28:41Z","input":"xxh64:01c75644250204b3"},"bitnami":{"captured":"2026-10-21T00:29:38Z","input":"xxh64:1e89be823aa2160a"},"chainguard":{"captured":"2026-10-21T00:29:10Z","input":"xxh64:86f35bccb88cf34a"},"chainguard-libraries":{"captured":"2026-10-21T00:28:47Z","input":"xxh64:2f80a2684e68edd8"},"debian":{"captured":"2026-10-21T00:29:27Z","input":"xxh64:1a5f4869d0ba88ba"},"echo":{"captured":"2026-10-21T00:28:47Z","input":"xxh64:c5609145822d1c5b"},"eol":{"captured":"2026-10-21T00:28:45Z","input":"xxh64:1c7a3b8eb4b865ec"},"epss":{"captured":"2026-10-21T00:29:38Z","input":"xxh64:55fbc7bde5c2f9b7"},"fedora":{"captured":"2026-10-21T00:28:45Z","input":"xxh64:594b89a41a0f5bba"},"github":{"captured":"2026-10-21T00:29:03Z","input":"xxh64:575e97ba73d59eb3"},"govulndb":{"captured":"2026-10-21T00:29:03Z","input":"xxh64:a7d2fa132cfd5f49"},"hummingbird":{"captured":"2026-10-21T00:30:32Z","input":"xxh64:0949d7cec55ba85d"},"kev":{"captured":"2026-10-21T00:28:52Z","input":"xxh64:54b536a9717bd576"},"mariner":{"captured":"2026-10-21T00:28:49Z","input":"xxh64:5f05ed462efd39c1"},"minimos":{"captured":"2026-10-21T00:29:10Z","input":"xxh64:fd78d08b2fb29c9f"},"nvd":{"captured":"2026-10-21T00:29:38Z","input":"xxh64:8315ef3507b66ede"},"oracle":{"captured":"2026-10-21T00:29:14Z","input":"xxh64:a7a64f1888a5f2a4"},"photon":{"captured":"2026-10-21T00:29:20Z","input":"xxh64:4357ab4e926683c4"},"rhel":{"captured":"2026-10-21T00:30:10Z","input":"xxh64:5a7d5ce4f05906de"},"secureos":{"captured":"2026-10-21T00:28:52Z","input":"xxh64:34f8fc9461599365"},"sles":{"captured":"2026-10-21T00:30:22Z","input":"xxh64:fbfc2a8303b56dd1"},"ubuntu":{"captured":"2026-10-21T00:29:39Z","input":"xxh64:e840825ef32aceeb"},"wolfi":{"captured":"2026-10-21T00:29:08Z","input":"xxh64:01054353e1822d25"}}},"timestamp":"2026-10-21T19:30:46.428323854Z"}}