{
  "bomFormat": "CycloneDX",
  "specVersion": "1.4",
  "serialNumber": "urn:uuid:b3f217b7-a716-43f4-822f-838650d86e96",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-10T19:07:49.268140+00:00",
    "tools": [
      {
        "name": "yocto"
      }
    ]
  },
  "vulnerabilities": [
    {
      "id": "CVE-2025-56005",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-56005"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Exploitation requires application-specific use of PLY's picklefile parameter with attacker-controlled pickle data\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#fda08a41-ec52-4ec0-9838-f7e7a5501242"
        }
      ]
    },
    {
      "id": "CVE-2025-59777",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59777"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: experimental code not compiled\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#dce1634f-8c06-4625-85c6-60292278d3d9"
        }
      ]
    },
    {
      "id": "CVE-2025-62689",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62689"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: experimental code not compiled\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#dce1634f-8c06-4625-85c6-60292278d3d9"
        }
      ]
    },
    {
      "id": "CVE-2023-37769",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-37769"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: stress-test is an uninstalled test\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#e1b31542-5204-4013-bcb2-fd4c1b81c1d2"
        }
      ]
    },
    {
      "id": "CVE-2026-14164",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Double-free regression in the RAR5 reader's init_unpack() was introduced upstream by commit 620bdafa (2026-05-16) and existed only on the git master branch until the fix in PR #3071 (commit 1c914cdf, 2026-05-24). It was never part of an upstream release tarball.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#f51d1d73-2d68-4c7e-8e3b-80c72a762e2a"
        }
      ]
    },
    {
      "id": "CVE-2018-13410",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13410"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Disputed and also Debian doesn't consider a vulnerability\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6863a773-4655-4011-82c6-c9c8b5c995bc"
        }
      ]
    },
    {
      "id": "CVE-2018-13684",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13684"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: cpe-incorrect\nJUSTIFICATION: Not for zip but for smart contract implementation for it\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6863a773-4655-4011-82c6-c9c8b5c995bc"
        }
      ]
    },
    {
      "id": "CVE-2024-3566",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3566"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#172509df-dae3-405e-8213-30ca1f46db2e"
        }
      ]
    },
    {
      "id": "CVE-2025-0913",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0913"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#172509df-dae3-405e-8213-30ca1f46db2e"
        }
      ]
    },
    {
      "id": "CVE-2026-39836",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39836"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#172509df-dae3-405e-8213-30ca1f46db2e"
        }
      ]
    },
    {
      "id": "CVE-2022-3479",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3479"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: vulnerability was introduced in 3.77 and fixed in 3.87\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#80e3bfc9-50f3-456f-8b65-18cc727261f9"
        }
      ]
    },
    {
      "id": "CVE-2017-11695",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11695"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This only affect the legacy db (libnssdbm), only compiled with --enable-legacy-db\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#80e3bfc9-50f3-456f-8b65-18cc727261f9"
        }
      ]
    },
    {
      "id": "CVE-2017-11696",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11696"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This only affect the legacy db (libnssdbm), only compiled with --enable-legacy-db\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#80e3bfc9-50f3-456f-8b65-18cc727261f9"
        }
      ]
    },
    {
      "id": "CVE-2017-11697",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11697"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This only affect the legacy db (libnssdbm), only compiled with --enable-legacy-db\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#80e3bfc9-50f3-456f-8b65-18cc727261f9"
        }
      ]
    },
    {
      "id": "CVE-2017-11698",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-11698"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This only affect the legacy db (libnssdbm), only compiled with --enable-legacy-db\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#80e3bfc9-50f3-456f-8b65-18cc727261f9"
        }
      ]
    },
    {
      "id": "CVE-2020-27569",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27569"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: Applies only Aviatrix OpenVPN client, not openvpn\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ff7478e-8796-41b1-890d-a383cf257fdc"
        }
      ]
    },
    {
      "id": "CVE-2025-13751",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13751"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: The vulnerability is Windows specific\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ff7478e-8796-41b1-890d-a383cf257fdc"
        }
      ]
    },
    {
      "id": "CVE-2024-24576",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-24576"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#70de29b5-f12c-488d-9a5f-fadb5cdde54c"
        }
      ]
    },
    {
      "id": "CVE-2024-43402",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-43402"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#70de29b5-f12c-488d-9a5f-fadb5cdde54c"
        }
      ]
    },
    {
      "id": "CVE-2024-3566",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-3566"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#70de29b5-f12c-488d-9a5f-fadb5cdde54c"
        }
      ]
    },
    {
      "id": "CVE-2026-63380",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63380"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: only affects 2.2.1-alpha\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#f41ba8f3-730a-4989-89bb-ec826043118a"
        }
      ]
    },
    {
      "id": "CVE-2021-37322",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37322"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: cpe-incorrect\nJUSTIFICATION: Is a binutils 2.26 issue, not gcc\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#975810eb-5d90-49ec-b2ad-cb1effa399d1"
        }
      ]
    },
    {
      "id": "CVE-2023-4039",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-4039"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Fixed via CVE-2023-4039.patch included here. Set the status explictly to deal with all recipes that share the gcc-source\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#975810eb-5d90-49ec-b2ad-cb1effa399d1"
        }
      ]
    },
    {
      "id": "CVE-2008-0888",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-0888"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Patch from https://bugzilla.redhat.com/attachment.cgi?id=293893&action=diff applied to 6.0 source\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6c8e125b-b0eb-4692-9452-a9ea0ba257e6"
        }
      ]
    },
    {
      "id": "CVE-2023-25584",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25584"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: cpe-incorrect\nJUSTIFICATION: Applies only for version 2.40 and earlier\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#aeebc518-a954-4463-b7ba-c5fef45aba9a"
        }
      ]
    },
    {
      "id": "CVE-2025-1180",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1180"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: patched\nJUSTIFICATION: fixed by patch for CVE-2025-1176\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#aeebc518-a954-4463-b7ba-c5fef45aba9a"
        }
      ]
    },
    {
      "id": "CVE-2025-69650",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69650"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: observed behavior only in pre-release code, does not affect any tagged version\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#aeebc518-a954-4463-b7ba-c5fef45aba9a"
        }
      ]
    },
    {
      "id": "CVE-2025-69651",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69651"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: observed behavior only in pre-release code, does not affect any tagged version\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#aeebc518-a954-4463-b7ba-c5fef45aba9a"
        }
      ]
    },
    {
      "id": "CVE-2000-1213",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-1213"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Fixed in 2000-10-10, but the versioning of iputils breaks the version order.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#bf4ec4c5-0f37-41c5-976e-aaf79b9bcb5a"
        }
      ]
    },
    {
      "id": "CVE-2000-1214",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2000-1214"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Fixed in 2000-10-10, but the versioning of iputils breaks the version order.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#bf4ec4c5-0f37-41c5-976e-aaf79b9bcb5a"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b06ff256-c96e-4d9a-8079-a61039945d41"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1857c6c-1b3d-4597-90dd-e9b06781b9cd"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c3dbe88-7ddb-4d4b-8993-5216fde044ca"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#54099a54-f309-488c-8670-85ff81d524eb"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8e2a3a4f-db18-4822-864f-e720bbfca549"
        }
      ]
    },
    {
      "id": "CVE-2024-32928",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32928"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: ignored\nJUSTIFICATION: CURLOPT_SSL_VERIFYPEER was disabled on google cloud services causing a potential man in the middle attack\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2025-0725",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0725"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: gzip decompression of content-encoded HTTP responses with the `CURLOPT_ACCEPT_ENCODING` option, using zlib 1.2.0.3 or older\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2025-5025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2025-10966",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10966"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with wolfssl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2026-10536",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10536"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with HTTP/2\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2026-8458",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-8458"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: applicable only with GSS-API-backed Negotiate authentication\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2026-82209",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-82209"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: public suffix list support is disabled by the recipe with --without-libpsl\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e048661-73a4-4f21-9ca7-740b166b8165"
        }
      ]
    },
    {
      "id": "CVE-2011-1548",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1548"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#156496a9-efb4-47ca-a7f2-5f1ac111497b"
        }
      ]
    },
    {
      "id": "CVE-2011-1549",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1549"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#156496a9-efb4-47ca-a7f2-5f1ac111497b"
        }
      ]
    },
    {
      "id": "CVE-2011-1550",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-1550"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: CVE is debian, gentoo or SUSE specific on the way logrotate was installed/used\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#156496a9-efb4-47ca-a7f2-5f1ac111497b"
        }
      ]
    },
    {
      "id": "CVE-2018-20225",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-20225"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Exploitation requires use of --extra-index-url with a private package not present on the primary public index; pip intentionally selects the highest version across configured indexes\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#2077f7f2-fcdf-4437-bf13-64cca70afb03"
        }
      ]
    },
    {
      "id": "CVE-2016-2781",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-2781"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: runcon is not really a sandbox command, use `runcon ... setsid ...` to avoid this particular issue.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#dadf89e8-92a7-4cf0-8afc-ffd149905d77"
        }
      ]
    },
    {
      "id": "CVE-2024-5290",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-5290"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: this only affects Ubuntu and other platforms patching wpa-supplicant\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#15dae4b8-1f17-4ed5-91c2-8547d2015a00"
        }
      ]
    },
    {
      "id": "CVE-2007-2768",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-2768"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This CVE is specific to OpenSSH with the pam opie which we don't build/use here.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2014-9278",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-9278"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: This CVE is specific to OpenSSH server, as used in Fedora and Red Hat Enterprise Linux 7 and when running in a Kerberos environment\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2008-3844",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-3844"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Only applies to some distributed RHEL binaries.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2023-51767",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-51767"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: It was demonstrated on modified sshd and does not exist in upstream openssh https://bugzilla.mindrot.org/show_bug.cgi?id=3656#c1.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2026-3497",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3497"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Only affects GSSAPI Key Exchange patches used by some Linux distributions and does not exist in upstream openssh.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2026-59998",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59998"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: GSSAPI/Kerberos support is disabled in the default OpenSSH configuration\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#8ba9f9bc-3d63-404e-9d04-860e27f0c189"
        }
      ]
    },
    {
      "id": "CVE-2020-24490",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-24490"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: cpe-incorrect\nJUSTIFICATION: This issue has kernel fixes rather than bluez fixes\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#caddd268-fd61-4aee-96dd-8bec82ff6212"
        }
      ]
    },
    {
      "id": "CVE-2026-3832",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3832"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: vulnerable multi-record OCSP response handling was introduced in 3.8.8 and is not present in 3.8.4\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e6537e0-4636-4755-b12f-9c0a2a31e5a0"
        }
      ]
    },
    {
      "id": "CVE-2026-1584",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-1584"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: vulnerable code not present, introduced with 3.8.11\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5e6537e0-4636-4755-b12f-9c0a2a31e5a0"
        }
      ]
    },
    {
      "id": "CVE-2025-6018",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6018"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: Default PAM config does not use user_readenv=1\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5c4425af-b303-497c-bef3-8d2c61bcc793"
        }
      ]
    },
    {
      "id": "CVE-2014-4715",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-4715"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: Fixed in r118, which is larger than the current version.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#e505c2e1-2710-4317-8322-a9a431304059"
        }
      ]
    },
    {
      "id": "CVE-2023-45322",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-45322"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: issue requires memory allocation to fail\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b4a2cf4f-5eee-4d54-89dc-9e76cf657144"
        }
      ]
    },
    {
      "id": "CVE-2025-8732",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8732"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: the code maintainer explains, that the issue can only be triggered with untrusted SGML catalogs and it makes absolutely no sense to use untrusted catalogs. The issue triggers a crash if an invalid file is provided.  https://gitlab.gnome.org/GNOME/libxml2/-/issues/958\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#b4a2cf4f-5eee-4d54-89dc-9e76cf657144"
        }
      ]
    },
    {
      "id": "CVE-2026-4176",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4176"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: we do not use the vendorered zlib\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a0c6203b-8845-4983-aeb5-3c230de265c7"
        }
      ]
    },
    {
      "id": "CVE-2024-35325",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35325"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: Upstream thinks this is a misuse (or wrong use) of the libyaml API - https://github.com/yaml/libyaml/issues/303\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#f2b601c4-f106-4298-b8bb-e40211faeaa8"
        }
      ]
    },
    {
      "id": "CVE-2024-35326",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35326"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#f2b601c4-f106-4298-b8bb-e40211faeaa8"
        }
      ]
    },
    {
      "id": "CVE-2024-35328",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35328"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: Upstream thinks there is no working code that is exploitable - https://github.com/yaml/libyaml/issues/302\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#f2b601c4-f106-4298-b8bb-e40211faeaa8"
        }
      ]
    },
    {
      "id": "CVE-2026-22184",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22184"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: vulnerable file is not compiled\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#90dd7de5-767e-4d4f-9b87-43ee59c50d88"
        }
      ]
    },
    {
      "id": "CVE-2026-22184",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22184"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: vulnerable file is not compiled\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#7650bce7-d439-4ad1-9276-228fad72a938"
        }
      ]
    },
    {
      "id": "CVE-2024-47611",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47611"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#edc4197f-7791-4083-abcf-2fb9808e3f7e"
        }
      ]
    },
    {
      "id": "CVE-2021-46828",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-46828"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: fixed-version\nJUSTIFICATION: fixed in 1.3.3rc1 so not present in 1.3.3\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#247786cd-782f-4bec-9e72-32bed5884b3f"
        }
      ]
    },
    {
      "id": "CVE-2025-4056",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4056"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9938025b-d10a-499d-a407-e525908d65e6"
        }
      ]
    },
    {
      "id": "CVE-2019-1010025",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010025"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Allows for ASLR bypass so can bypass some hardening, not an exploit in itself, may allow easier access for another. 'ASLR bypass itself is not a vulnerability.'\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2019-1010022",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010022"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream glibc maintainers dispute there is any issue and have no plans to address it further. this is being treated as a non-security bug and no real threat.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2019-1010023",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010023"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream glibc maintainers dispute there is any issue and have no plans to address it further. this is being treated as a non-security bug and no real threat.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2019-1010024",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010024"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream glibc maintainers dispute there is any issue and have no plans to address it further. this is being treated as a non-security bug and no real threat.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2024-2961",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-2961"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2024-33599",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33599"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2024-33600",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33600"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2024-33601",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33601"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2024-33602",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33602"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2025-0395",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0395"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2025-4802",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4802"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2025-5702",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-5702"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2025-8058",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8058"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2025-15281",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15281"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2026-0861",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0861"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2026-0915",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0915"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2026-4046",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4046"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2026-4437",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4437"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2026-4438",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4438"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: fix available in used git hash\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#6693387c-870d-4a5b-bf12-79d2b9274f85"
        }
      ]
    },
    {
      "id": "CVE-2011-3374",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3374"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: apt-key net-update is disabled by default and Debian vendor configuration has no archive keyring URI\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#598d38a4-03f2-4324-b8a8-26a9ef2c737c"
        }
      ]
    },
    {
      "id": "CVE-2011-3374",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-3374"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: apt-key net-update is disabled by default and Debian vendor configuration has no archive keyring URI\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#ecf580e9-fa59-4333-b776-47610d5ba0ff"
        }
      ]
    },
    {
      "id": "CVE-2013-4235",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4235"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: Severity is low and marked as closed and won't fix.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#1680c878-5471-4d2e-a0a7-cf8846b67be4"
        }
      ]
    },
    {
      "id": "CVE-2013-4235",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4235"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: Severity is low and marked as closed and won't fix.\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#45fa4f0d-1775-4aed-84c8-f020790d5fa6"
        }
      ]
    },
    {
      "id": "CVE-2021-26720",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26720"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only affects Debian/SUSE\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#15ce0201-c35a-4c94-9b54-18aee277ec0a"
        }
      ]
    },
    {
      "id": "CVE-2025-66476",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66476"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#5aff0299-108f-4c5e-a1a3-3108b3d7ba9b"
        }
      ]
    },
    {
      "id": "CVE-2007-4559",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream consider this expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2019-18348",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18348"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This is not exploitable when glibc has CVE-2016-10739 fixed\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2020-15523",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15523"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2022-26488",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26488"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2015-20107",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20107"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: The mailcap module is insecure by design, so this can't be fixed in a meaningful way\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2023-36632",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36632"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Not an issue, in fact expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2026-3087",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3087"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2025-12084",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12084"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2025-13462",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2025-13837",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2026-3644",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2026-4519",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2026-7210",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#9e3e1c02-12ff-491e-a55c-a03cd1d7128e"
        }
      ]
    },
    {
      "id": "CVE-2007-4559",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream consider this expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2019-18348",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18348"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This is not exploitable when glibc has CVE-2016-10739 fixed\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2020-15523",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15523"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2022-26488",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26488"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2015-20107",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20107"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: The mailcap module is insecure by design, so this can't be fixed in a meaningful way\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2023-36632",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36632"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Not an issue, in fact expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2026-3087",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3087"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2025-12084",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12084"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2025-13462",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2025-13837",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2026-3644",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2026-4519",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2026-7210",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#a703003e-04b5-465e-8e0a-0af60372439e"
        }
      ]
    },
    {
      "id": "CVE-2007-4559",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2007-4559"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Upstream consider this expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2019-18348",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-18348"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-config\nJUSTIFICATION: This is not exploitable when glibc has CVE-2016-10739 fixed\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2020-15523",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15523"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2022-26488",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26488"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2015-20107",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-20107"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: upstream-wontfix\nJUSTIFICATION: The mailcap module is insecure by design, so this can't be fixed in a meaningful way\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2023-36632",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36632"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: disputed\nJUSTIFICATION: Not an issue, in fact expected behaviour\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2026-3087",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3087"
      },
      "analysis": {
        "state": "not_affected",
        "detail": "STATE: not-applicable-platform\nJUSTIFICATION: Issue only applies on Windows\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2025-12084",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-12084"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2025-13462",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13462"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2025-13837",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13837"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.13\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2026-3644",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3644"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2026-4519",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4519"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    },
    {
      "id": "CVE-2026-7210",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-7210"
      },
      "analysis": {
        "state": "resolved",
        "detail": "STATE: cpe-stable-backport\nJUSTIFICATION: Fixed in v3.12.14\n"
      },
      "affects": [
        {
          "ref": "urn:cdx:327343b5-b05c-4036-bb7f-a19aa4d06cfb/1#c1d213a6-1887-4c2e-871d-0bbe2dd21af3"
        }
      ]
    }
  ]
}