{"matches":[{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00291,"percentile":0.19912,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.16732499999999997},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"fef07e9c95ea2bda","name":"busybox","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:9378b3e771a71bb05c8d797c0777e6fae75dc34e80ef7ed7a242e10d74cb4d27","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}],"Arch":"x86_64"}}},{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00291,"percentile":0.19912,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.16732499999999997},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"915155597fcdee9a","name":"busybox-binsh","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:9378b3e771a71bb05c8d797c0777e6fae75dc34e80ef7ed7a242e10d74cb4d27","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/bin"},{"path":"/bin/sh"}],"Arch":"x86_64"}}},{"vulnerability":{"id":"CVE-2025-60876","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-60876","epss":0.00291,"percentile":0.19912,"date":"2026-10-09"}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":""},"advisories":[],"risk":0.16732499999999997},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"apk-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"}},"found":{"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)","cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"]}}],"artifact":{"id":"8a9ef44e1018f213","name":"ssl_client","version":"1.37.0-r31","type":"apk","locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:9378b3e771a71bb05c8d797c0777e6fae75dc34e80ef7ed7a242e10d74cb4d27","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"language":"","licenses":["GPL-2.0-only"],"cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.2&upstream=busybox","upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata","metadata":{"files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}],"Arch":"x86_64"}}}],"source":{"type":"image","target":{"userInput":"build/payload/traefik-v3.7.14-tpio.1","imageID":"sha256:b95e7bd5e671b5e697968f5883fea39b24729ea085f659b3288fe6567e5429de","manifestDigest":"sha256:409042a74e0c1a0f882dc90c7694b4933e13ade589defe4e814882a151427ef5","mediaType":"application/vnd.oci.image.manifest.v1+json","tags":[],"imageSize":384262047,"layers":[{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:74d97c428c51a828f9051a7a40a53ff1fc99e54fc30323ce36760701b0b7f711","size":8417144},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:275ab143d996dd0a54c239e9913e6cfd09b8fdae86a758cdb88bb93cd75c1221","size":903347},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:a5c4798852293125a9c60737cd801cebcc1b73ecda54f57bd445dcac4a7b3799","size":185000098},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:a6869adabf77d94578ddb99cb3b9abaff02948373fdf2c505c457e4c3745bdd5","size":419},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:9378b3e771a71bb05c8d797c0777e6fae75dc34e80ef7ed7a242e10d74cb4d27","size":6411339},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:d196b4609a89c116d90c0ebbf6c93d1b988a7c188f0e8df402aa9d68a81d1630","size":183529634},{"mediaType":"application/vnd.oci.image.layer.v1.tar+gzip","digest":"sha256:611dbdab2012694bbabcdbe92eea5f06f9ed8afd5384dc9bd3da9e08da41cd73","size":66}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLm1hbmlmZXN0LnYxK2pzb24iLCJjb25maWciOnsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5jb25maWcudjEranNvbiIsImRpZ2VzdCI6InNoYTI1NjpiOTVlN2JkNWU2NzFiNWU2OTc5NjhmNTg4M2ZlYTM5YjI0NzI5ZWEwODVmNjU5YjMyODhmZTY1NjdlNTQyOWRlIiwic2l6ZSI6NTMzNX0sImxheWVycyI6W3sibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo0ZmRjNTZhMWQ0OWZjNzQ5ZjRiNmQ1M2U0NjhhMDQ2Y2QxYTAxOWU3YjEwOGIxZTVjOTU0YTQzNTQ4ZTM5OTdkIiwic2l6ZSI6Mzk2OTk2N30seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQub2NpLmltYWdlLmxheWVyLnYxLnRhcitnemlwIiwiZGlnZXN0Ijoic2hhMjU2OjYyMDJmN2U0OWU4OGJiN2NhYmNmODc4MzFmY2JiNzFkM2EyNzY3Yjc1MzEzYmExZjU0N2Q5MDI5ZGNiNmFhZGEiLCJzaXplIjo0MjQwMTR9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjpiNDNmMjE0Y2UxYjMwYTA5NDRmMzljOWE4ZDk4OGEzZDcxYTA5ZmFhYTIyNjk4NWY5N2U3YjRjYTdjYzEzYTBjIiwic2l6ZSI6NTM0MTYzNDl9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1Njo2MzUzYzFmYzJhMGVlNWZjODM3Zjc1YmEzNmYwZDE5ZjBhYmEwYmU1MjE0YTQ3ZjgwYWVmMDAwNjc2NmEyYmM0Iiwic2l6ZSI6MzczfSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5vY2kuaW1hZ2UubGF5ZXIudjEudGFyK2d6aXAiLCJkaWdlc3QiOiJzaGEyNTY6YWMyYzgzYzQ2MDczZjVkMzkzNjYxMTcwOGM1MjM4ZDQ0ZTM5NTU2ZDUwMWFiZGJmNmZlZWVmMWE4MTZkNDY0YyIsInNpemUiOjI3NTI3NDB9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjphYmExMjk2Y2ZmZDhhMmEyOTQzMWExYTcyMzQ0MTI4MTI3OWUyZTgyMzdhYTlhNjA3MTg4MTUzN2FiN2Y3N2E5Iiwic2l6ZSI6NTI2MzEyMDB9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLm9jaS5pbWFnZS5sYXllci52MS50YXIrZ3ppcCIsImRpZ2VzdCI6InNoYTI1NjoyOWVkNzBlZDg2MzE0MjU1MTgxNzY5YjZmZDYyMTA0YzEwOWM1NDU0MDgyYzI5YjcyYWZkZDM4ODgzNjI4ZDZiIiwic2l6ZSI6Mjg4fV0sImFubm90YXRpb25zIjp7ImNvbS5kb2NrZXIub2ZmaWNpYWwtaW1hZ2VzLmJhc2hicmV3LmFyY2giOiJhbWQ2NCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5iYXNlLmRpZ2VzdCI6InNoYTI1Njo1OTAyZDY4ZTAwNzA4MDE1NzM2NDE2YjYyZmFhNDlkMjNhMmUxZDQ0MTU2NDllNTgzMWQyMGI3OWJhMzAxNTA4Iiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmJhc2UubmFtZSI6ImRvY2tlci5pby9saWJyYXJ5L3RyYWVmaWtAc2hhMjU2OjU3NWZhMTViMTM1MDc4ZmU1ZTUwYWE4NDc5ODdkOTZkYmRkZDdiMDkzYzE3MjQyOTYxODQwNGRmNzNmM2ZhN2MiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjE6NDY6MTAuNDg4ODg2NDk0WiIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbiI6IjczMTNkNzc0MjgxMzE4NTUzYTFhN2RjMTMxYjMyYjUyMTA0MzcwNjkiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlIjoiaHR0cHM6Ly9naXRodWIuY29tL3RyYWVmaWsvdHJhZWZpay1saWJyYXJ5LWltYWdlLmdpdCM3MzEzZDc3NDI4MTMxODU1M2ExYTdkYzEzMWIzMmI1MjEwNDM3MDY5OnYzLjcvYWxwaW5lIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybCI6Imh0dHBzOi8vaHViLmRvY2tlci5jb20vXy90cmFlZmlrIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb24iOiJ2My43LjE0In19","config":"eyJjcmVhdGVkIjoiMjAyNi0xMC0xMFQyMTo0NjoxMC40ODg4ODY0OTRaIiwiYXJjaGl0ZWN0dXJlIjoiYW1kNjQiLCJvcyI6ImxpbnV4IiwiY29uZmlnIjp7IlVzZXIiOiJyb290IiwiRXhwb3NlZFBvcnRzIjp7IjgwL3RjcCI6e319LCJFbnYiOlsiUEFUSD0vdXNyL2xvY2FsL3NiaW46L3Vzci9sb2NhbC9iaW46L3Vzci9zYmluOi91c3IvYmluOi9zYmluOi9iaW4iXSwiRW50cnlwb2ludCI6WyIvZW50cnlwb2ludC5zaCJdLCJDbWQiOlsidHJhZWZpayJdLCJXb3JraW5nRGlyIjoiLyIsIkxhYmVscyI6eyJpby5idWlsZGFoLnZlcnNpb24iOiIxLjQzLjEiLCJpby50aGVwZW9wbGVzLmhhcmRlbmVkLmNsYWltIjoicGFja2FnZS1maXhhYmxlIENSSVRJQ0FML0hJR0ggY2xlYXJlZCB2cyB1cHN0cmVhbSBkaWdlc3Q7IG5vdCBGSVBTL0ZlZFJBTVAiLCJpby50aGVwZW9wbGVzLmhhcmRlbmVkLmxhZGRlciI6ImErYitjIiwiaW8udGhlcGVvcGxlcy5oYXJkZW5lZC5yZXBsYWNlcyI6ImRvY2tlci5pby9saWJyYXJ5L3RyYWVmaWs6djMuNy4xNEBzaGEyNTY6NTc1ZmExNWIxMzUwNzhmZTVlNTBhYTg0Nzk4N2Q5NmRiZGRkN2IwOTNjMTcyNDI5NjE4NDA0ZGY3M2YzZmE3YyIsImlvLnRoZXBlb3BsZXMuaGFyZGVuZWQudXBzdHJlYW0iOiJkb2NrZXIuaW8vbGlicmFyeS90cmFlZmlrOnYzLjcuMTRAc2hhMjU2OjU3NWZhMTViMTM1MDc4ZmU1ZTUwYWE4NDc5ODdkOTZkYmRkZDdiMDkzYzE3MjQyOTYxODQwNGRmNzNmM2ZhN2MiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuZGVzY3JpcHRpb24iOiJBIG1vZGVybiByZXZlcnNlLXByb3h5Iiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb24iOiJodHRwczovL2RvY3MudHJhZWZpay5pbyIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5zb3VyY2UiOiJodHRwczovL2dpdGh1Yi5jb20vdHJhZWZpay90cmFlZmlrIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnRpdGxlIjoiVHJhZWZpayIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS51cmwiOiJodHRwczovL3RyYWVmaWsuaW8iLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yIjoiVHJhZWZpayBMYWJzIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb24iOiJ2My43LjE0In19LCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1Njo3NGQ5N2M0MjhjNTFhODI4ZjkwNTFhN2E0MGE1M2ZmMWZjOTllNTRmYzMwMzIzY2UzNjc2MDcwMWIwYjdmNzExIiwic2hhMjU2OjI3NWFiMTQzZDk5NmRkMGE1NGMyMzllOTkxM2U2Y2ZkMDliOGZkYWU4NmE3NThjZGI4OGJiOTNjZDc1YzEyMjEiLCJzaGEyNTY6YTVjNDc5ODg1MjI5MzEyNWE5YzYwNzM3Y2Q4MDFjZWJjYzFiNzNlY2RhNTRmNTdiZDQ0NWRjYWM0YTdiMzc5OSIsInNoYTI1NjphNjg2OWFkYWJmNzdkOTQ1NzhkZGI5OWNiM2I5YWJhZmYwMjk0ODM3M2ZkZjJjNTA1YzQ1N2U0YzM3NDViZGQ1Iiwic2hhMjU2OjkzNzhiM2U3NzFhNzFiYjA1YzhkNzk3YzA3NzdlNmZhZTc1ZGMzNGU4MGVmN2VkN2EyNDJlMTBkNzRjYjRkMjciLCJzaGEyNTY6ZDE5NmI0NjA5YTg5YzExNmQ5MGMwZWJiZjZjOTNkMWI5ODhhN2MxODhmMGU4ZGY0MDJhYTlkNjhhODFkMTYzMCIsInNoYTI1Njo2MTFkYmRhYjIwMTI2OTRiYmFiY2RiZTkyZWVhNWYwNmY5ZWQ4YWZkNTM4NGRjOWJkM2RhOWUwOGRhNDFjZDczIl19LCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMjAyNi0wOS0xN1QyMDozNzoyMC44ODkyMjE4NzlaIiwiY3JlYXRlZF9ieSI6IkFERCBhbHBpbmUtbWluaXJvb3Rmcy0zLjI0LjIteDg2XzY0LnRhci5neiAvICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjYtMDktMTdUMjA6Mzc6MjAuODg5MjIxODc5WiIsImNyZWF0ZWRfYnkiOiJDTUQgW1wiL2Jpbi9zaFwiXSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NDg6MDEuNjg2Nzg2NDY3WiIsImNyZWF0ZWRfYnkiOiJSVU4gL2Jpbi9zaCAtYyBhcGsgLS1uby1jYWNoZSBhZGQgY2EtY2VydGlmaWNhdGVzIHR6ZGF0YSAjIGJ1aWxka2l0IiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjQ4OjA0LjA2ODU5MTM2WiIsImNyZWF0ZWRfYnkiOiJSVU4gL2Jpbi9zaCAtYyBzZXQgLWV4OyBcdGFwa0FyY2g9XCIkKGFwayAtLXByaW50LWFyY2gpXCI7IFx0Y2FzZSBcIiRhcGtBcmNoXCIgaW4gXHRcdGFybWhmKSBhcmNoPSdhcm12NicgOzsgICAgICAgICBhcm12NykgYXJjaD0nYXJtdjcnIDs7IFx0XHRhYXJjaDY0KSBhcmNoPSdhcm02NCcgOzsgXHRcdHg4Nl82NCkgYXJjaD0nYW1kNjQnIDs7IFx0XHRyaXNjdjY0KSBhcmNoPSdyaXNjdjY0JyA7OyBcdFx0czM5MHgpIGFyY2g9J3MzOTB4JyA7OyBcdFx0cHBjNjRsZSkgYXJjaD0ncHBjNjRsZScgOzsgXHRcdCopIGVjaG8gXHUwMDNlXHUwMDI2MiBcImVycm9yOiB1bnN1cHBvcnRlZCBhcmNoaXRlY3R1cmU6ICRhcGtBcmNoXCI7IGV4aXQgMSA7OyBcdGVzYWM7IFx0d2dldCAtLXF1aWV0IC1PIC90bXAvdHJhZWZpay50YXIuZ3ogXCJodHRwczovL2dpdGh1Yi5jb20vdHJhZWZpay90cmFlZmlrL3JlbGVhc2VzL2Rvd25sb2FkL3YzLjcuMTQvdHJhZWZpa192My43LjE0X2xpbnV4XyRhcmNoLnRhci5nelwiOyBcdHRhciB4enZmIC90bXAvdHJhZWZpay50YXIuZ3ogLUMgL3Vzci9sb2NhbC9iaW4gdHJhZWZpazsgXHRybSAtZiAvdG1wL3RyYWVmaWsudGFyLmd6OyBcdGNobW9kICt4IC91c3IvbG9jYWwvYmluL3RyYWVmaWsgIyBidWlsZGtpdCIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIn0seyJjcmVhdGVkIjoiMjAyNi0xMC0wNlQxNzo0ODowNC4xMjAyMzMyNzVaIiwiY3JlYXRlZF9ieSI6IkNPUFkgZW50cnlwb2ludC5zaCAvICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NDg6MDQuMTIwMjMzMjc1WiIsImNyZWF0ZWRfYnkiOiJFWFBPU0UgbWFwWzgwL3RjcDp7fV0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTA2VDE3OjQ4OjA0LjEyMDIzMzI3NVoiLCJjcmVhdGVkX2J5IjoiRU5UUllQT0lOVCBbXCIvZW50cnlwb2ludC5zaFwiXSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NDg6MDQuMTIwMjMzMjc1WiIsImNyZWF0ZWRfYnkiOiJDTUQgW1widHJhZWZpa1wiXSIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMDZUMTc6NDg6MDQuMTIwMjMzMjc1WiIsImNyZWF0ZWRfYnkiOiJMQUJFTCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPVRyYWVmaWsgTGFicyBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsPWh0dHBzOi8vdHJhZWZpay5pbyBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlPWh0dHBzOi8vZ2l0aHViLmNvbS90cmFlZmlrL3RyYWVmaWsgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnRpdGxlPVRyYWVmaWsgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPUEgbW9kZXJuIHJldmVyc2UtcHJveHkgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249djMuNy4xNCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuZG9jdW1lbnRhdGlvbj1odHRwczovL2RvY3MudHJhZWZpay5pbyIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjE6NDU6NDguODA1NzQzMDY1WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBVU0VSIHJvb3QiLCJjb21tZW50IjoiRlJPTSBkb2NrZXIuaW8vbGlicmFyeS90cmFlZmlrQHNoYTI1Njo1NzVmYTE1YjEzNTA3OGZlNWU1MGFhODQ3OTg3ZDk2ZGJkZGQ3YjA5M2MxNzI0Mjk2MTg0MDRkZjczZjNmYTdjIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjE6NDU6NTkuMDAwNzM0OTY2WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jIGFwayB1cGdyYWRlIC0tbm8tY2FjaGUgLS1hdmFpbGFibGUgXHUwMDI2XHUwMDI2IHJtIC1yZiAvdmFyL2NhY2hlL2Fway8qIFx1MDAyNlx1MDAyNiBhcGsgbGlzdCAtLWluc3RhbGxlZCBcdTAwM2UgL2V0Yy90cC1oYXJkZW5lZC5hcGstbWFuaWZlc3QifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEwVDIxOjQ2OjAzLjAwMDc4NTQ5MloiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgQ09QWSBmaWxlOjZmMTU3MjdhMjNlYWU5NzE2Y2VlNjE4Zjc5MzdiMmFmOWNlMzI2NTY1ODkyM2FkMzcyMmRhYWMxOGE3MGExMWYgaW4gL3Vzci9sb2NhbC9iaW4vdHJhZWZpayAgICAgICJ9LHsiY3JlYXRlZCI6IjIwMjYtMTAtMTBUMjE6NDY6MDcuMDAwMzQ0MDI2WiIsImNyZWF0ZWRfYnkiOiIvYmluL3NoIC1jICMobm9wKSBDT1BZIG11bHRpOjg5OTc4NDM3ODQ2ZGUyNDA2MzFiZDhmM2JmM2Y2MThmOGE4ZjYwMDU5ZGFmMWM2MzFmY2U3NDQ5YTI2MGJlY2EgaW4gL3Vzci9zaGFyZS90cC1oYXJkZW5lZC8gICAgICAifSx7ImNyZWF0ZWQiOiIyMDI2LTEwLTEwVDIxOjQ2OjEwLjQ4OTMwMzY2N1oiLCJjcmVhdGVkX2J5IjoiL2Jpbi9zaCAtYyAjKG5vcCkgTEFCRUwgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlcnNpb249XCJ2My43LjE0XCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC51cHN0cmVhbT1cImRvY2tlci5pby9saWJyYXJ5L3RyYWVmaWs6djMuNy4xNEBzaGEyNTY6NTc1ZmExNWIxMzUwNzhmZTVlNTBhYTg0Nzk4N2Q5NmRiZGRkN2IwOTNjMTcyNDI5NjE4NDA0ZGY3M2YzZmE3Y1wiICAgICAgIGlvLnRoZXBlb3BsZXMuaGFyZGVuZWQucmVwbGFjZXM9XCJkb2NrZXIuaW8vbGlicmFyeS90cmFlZmlrOnYzLjcuMTRAc2hhMjU2OjU3NWZhMTViMTM1MDc4ZmU1ZTUwYWE4NDc5ODdkOTZkYmRkZDdiMDkzYzE3MjQyOTYxODQwNGRmNzNmM2ZhN2NcIiAgICAgICBpby50aGVwZW9wbGVzLmhhcmRlbmVkLmxhZGRlcj1cImErYitjXCIgICAgICAgaW8udGhlcGVvcGxlcy5oYXJkZW5lZC5jbGFpbT1cInBhY2thZ2UtZml4YWJsZSBDUklUSUNBTC9ISUdIIGNsZWFyZWQgdnMgdXBzdHJlYW0gZGlnZXN0OyBub3QgRklQUy9GZWRSQU1QXCIiLCJlbXB0eV9sYXllciI6dHJ1ZX1dfQ==","repoDigests":[],"architecture":"amd64","os":"linux","labels":{"io.buildah.version":"1.43.1","io.thepeoples.hardened.claim":"package-fixable CRITICAL/HIGH cleared vs upstream digest; not FIPS/FedRAMP","io.thepeoples.hardened.ladder":"a+b+c","io.thepeoples.hardened.replaces":"docker.io/library/traefik:v3.7.14@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c","io.thepeoples.hardened.upstream":"docker.io/library/traefik:v3.7.14@sha256:575fa15b135078fe5e50aa847987d96dbddd7b093c172429618404df73f3fa7c","org.opencontainers.image.description":"A modern reverse-proxy","org.opencontainers.image.documentation":"https://docs.traefik.io","org.opencontainers.image.source":"https://github.com/traefik/traefik","org.opencontainers.image.title":"Traefik","org.opencontainers.image.url":"https://traefik.io","org.opencontainers.image.vendor":"Traefik Labs","org.opencontainers.image.version":"v3.7.14"}}},"distro":{"name":"alpine","version":"3.24.2","idLike":[]},"descriptor":{"name":"grype","version":"0.120.1","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"linux/amd64","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-kbuild-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":false,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"include-matcher-suppressions":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"},"ubuntu-esm":{"apply":"auto","versions":""}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/tmp/hardened-scanner-session.c5e1E1/grype","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.10","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.10_2026-10-10T00:34:49Z_1791613801.tar.zst?checksum=sha256%3A9c7673c1d8526a5696e6af4cd26f48c3d4ab34c30e40ffe212a811c44ab5f0c1","built":"2026-10-10T06:30:01Z","path":"/tmp/hardened-scanner-session.c5e1E1/grype/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-10-10T00:35:19Z","input":"xxh64:fa6021eeb96614ec"},"alpine":{"captured":"2026-10-10T00:35:30Z","input":"xxh64:935f13d8c01d6fc4"},"amazon":{"captured":"2026-10-10T00:35:25Z","input":"xxh64:bc05a09fe38da3bd"},"arch":{"captured":"2026-10-10T00:34:51Z","input":"xxh64:1d10d154d8868105"},"bitnami":{"captured":"2026-10-10T00:34:59Z","input":"xxh64:bc896cdb9eeaf19f"},"chainguard":{"captured":"2026-10-10T00:35:25Z","input":"xxh64:7edca4844746ccfc"},"chainguard-libraries":{"captured":"2026-10-10T00:35:18Z","input":"xxh64:3ae753c47503b831"},"debian":{"captured":"2026-10-10T00:35:03Z","input":"xxh64:e71e120e6da87253"},"echo":{"captured":"2026-10-10T00:35:17Z","input":"xxh64:0758ad31e1529030"},"eol":{"captured":"2026-10-10T00:34:49Z","input":"xxh64:93f53484fb0342e9"},"epss":{"captured":"2026-10-10T00:35:07Z","input":"xxh64:aa4a3b9cb47532ce"},"fedora":{"captured":"2026-10-10T00:34:58Z","input":"xxh64:091c01790140411d"},"github":{"captured":"2026-10-10T00:35:35Z","input":"xxh64:ce27bb531ca44b73"},"govulndb":{"captured":"2026-10-10T00:34:54Z","input":"xxh64:b365aa1c51dad946"},"hummingbird":{"captured":"2026-10-10T00:37:31Z","input":"xxh64:c267f95d54ac3219"},"kev":{"captured":"2026-10-10T00:34:58Z","input":"xxh64:b0d499c7f5ff1cee"},"mariner":{"captured":"2026-10-10T00:34:54Z","input":"xxh64:3c820d09ff8ad6a3"},"minimos":{"captured":"2026-10-10T00:34:57Z","input":"xxh64:951565842d89bb69"},"nvd":{"captured":"2026-10-10T00:35:53Z","input":"xxh64:8c63c4f719534506"},"oracle":{"captured":"2026-10-10T00:35:23Z","input":"xxh64:4cbf6a809d7cebdf"},"photon":{"captured":"2026-10-10T00:35:18Z","input":"xxh64:d14c5749066516cb"},"rhel":{"captured":"2026-10-10T00:36:12Z","input":"xxh64:6ee76ae7b60b3b4d"},"secureos":{"captured":"2026-10-10T00:35:00Z","input":"xxh64:99ea90bc73b51505"},"sles":{"captured":"2026-10-10T00:36:45Z","input":"xxh64:c2efa7ddee8ab23d"},"ubuntu":{"captured":"2026-10-10T00:35:51Z","input":"xxh64:ff5039bbd738c793"},"wolfi":{"captured":"2026-10-10T00:35:47Z","input":"xxh64:fac495e865ef7e24"}}},"timestamp":"2026-10-10T21:47:02.222061194Z"}}