{"schemaVersion":3,"id":"CVE-2026-102414","aliases":["UBUNTU-CVE-2026-102414","DEBIAN-CVE-2026-102414","CGA-26mm-54qp-24rw","CGA-7rq9-2cgg-779p","GHSA-477h-4r7f-fvrx","CGA-23mg-g7xr-xrg6","CGA-28fg-qgh9-fj9g","CGA-3v6w-pg42-4xgc","CGA-42hx-2g39-3vgf","CGA-45w9-fc7p-cfh6","CGA-4g3v-p5mx-3rj7","CGA-53g7-4x52-rp98","CGA-55w6-g2hp-cvhm","CGA-56jm-pmgj-cv3p","CGA-57j2-mcw7-g6w4","CGA-5jm3-hxhg-2j7c","CGA-5v4h-f84q-wqvv","CGA-5wcc-xqqq-f2v5","CGA-6426-vvwg-v9x5","CGA-64ph-wj23-j8g7","CGA-6j4v-2g44-h7xx","CGA-6p7g-5hmx-26vr","CGA-6wh7-9653-mx45","CGA-793c-qv58-fcvc","CGA-7gh6-ppxw-532j","CGA-7p6f-9v44-4rvc","CGA-8275-rrh5-77jx","CGA-846x-9p3w-x6f9","CGA-87cv-6vgc-5cfr","CGA-89qv-f6j2-hrfv","CGA-8gqg-8c3q-2phr","CGA-96q4-wc63-j93h","CGA-9r59-w82j-5qpj","CGA-9rr4-pvrp-6j49","CGA-9wv9-rw45-pc7j","CGA-cqhg-6p72-37mx","CGA-cwj3-22jh-68x4","CGA-cxhv-h444-jhjr","CGA-f4hg-m8c4-rqg2","CGA-f6cv-wvcg-2m88","CGA-f769-vv9p-w47w","CGA-ffv7-jgj9-39q5","CGA-fxg7-jfj5-jq8g","CGA-fxwx-4hqq-hm37","CGA-g2wr-vvww-mp3c","CGA-g6g8-gf47-6m42","CGA-gp2h-xmvr-cw2g","CGA-h4p5-x9vh-wxfm","CGA-h4vr-h99w-pw5j","CGA-h563-xr6p-v64x","CGA-h6j3-6jqm-6769","CGA-h8gg-2jpx-qm54","CGA-hq7v-6rp5-9p89","CGA-j92f-r22w-8xh7","CGA-m732-772p-cgfx","CGA-mx8r-phgx-7xc4","CGA-p49p-c9f5-5v32","CGA-p8fq-wg95-q2xc","CGA-pgj4-fjwj-hr3m","CGA-q38q-whhp-wfp6","CGA-qc6p-63m7-v6v2","CGA-qrg8-757r-j64q","CGA-qxj6-rq4p-xhqr","CGA-r295-gh3j-j77j","CGA-r748-498c-33r4","CGA-v2rx-h725-w7j9","CGA-vpmr-qfph-hgmc","CGA-vr7r-qfwq-phg4","CGA-w97j-rjvg-qgp7","CGA-wrf7-v7qf-xq88","CGA-ww6f-2p7f-g8x9","CGA-xj7r-5982-45mw","CGA-xvvv-mqr4-q74f","CGA-pwh7-c5ch-pqq5","CGA-26cr-hrx8-3j86","CGA-2cgm-75x4-g99h","CGA-62qc-j825-j57f"],"status":"published","duplicateOf":null,"title":null,"description":"pbkdf2 through 3.1.6 re-hashes passwords longer than the digest's block size on every iteration in its JavaScript fallback (lib/sync.js). A password longer than the block size (64 bytes, or 128 bytes for sha384 and sha512) is passed to HMAC as the key on every iteration, and HMAC hashes such keys in full each time. Cost is therefore O(iterations × password length), and a long password can block the event loop. The fallback is used by pbkdf2Sync and pbkdf2 on Node.js before 0.12, on Bun (1.0.0 through 1.1.34, and 1.2.6 and later), and on Deno 2.9.0 and later, because their native pbkdf2Sync fails the library's feature check. It is also used when lib/sync.js is imported directly. Node.js 0.12 and later, and browser builds (which use lib/sync-browser.js), are not affected. Applications that enforce a reasonable maximum password length are not meaningfully affected.","dates":{"published":"2026-09-29T03:42:04.950Z","modified":"2026-09-30T15:17:17.598Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":5.6,"impact":2.3,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Npm","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":5.6,"impact":2.3,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00284,"percentile":0.19648,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-09-29T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00284,"percentile":0.19648}],"last30":[{"date":"2026-09-29T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00284,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00284,"percentile":0.19648}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption","description":"The product does not properly control the allocation and maintenance of a limited resource.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/400.html"}],"affected":[{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.1","name":"commercial-gitlab-rails-ee-19.1","label":"commercial-gitlab-rails-ee-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.1","purlType":"apk","versions":[{"text":"< 19.1.7-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.7-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.2","name":"commercial-gitlab-rails-ee-19.2","label":"commercial-gitlab-rails-ee-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.3","name":"commercial-gitlab-rails-ee-19.3","label":"commercial-gitlab-rails-ee-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-19.4","name":"commercial-gitlab-rails-ee-19.4","label":"commercial-gitlab-rails-ee-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.1","name":"commercial-gitlab-rails-ee-fips-19.1","label":"commercial-gitlab-rails-ee-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.2","name":"commercial-gitlab-rails-ee-fips-19.2","label":"commercial-gitlab-rails-ee-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.2","purlType":"apk","versions":[{"text":"< 19.2.7-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.2.7-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.3","name":"commercial-gitlab-rails-ee-fips-19.3","label":"commercial-gitlab-rails-ee-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"commercial-gitlab-rails-ee-fips-19.4","name":"commercial-gitlab-rails-ee-fips-19.4","label":"commercial-gitlab-rails-ee-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/commercial-gitlab-rails-ee-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.0","name":"gitlab-rails-ce-19.0","label":"gitlab-rails-ce-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.0","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.1","name":"gitlab-rails-ce-19.1","label":"gitlab-rails-ce-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.1","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.2","name":"gitlab-rails-ce-19.2","label":"gitlab-rails-ce-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.3","name":"gitlab-rails-ce-19.3","label":"gitlab-rails-ce-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.4","name":"gitlab-rails-ce-19.4","label":"gitlab-rails-ce-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.4","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-19.5","name":"gitlab-rails-ce-19.5","label":"gitlab-rails-ce-19.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-19.5","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.1","name":"gitlab-rails-ce-fips-19.1","label":"gitlab-rails-ce-fips-19.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.1","purlType":"apk","versions":[{"text":"< 19.1.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.1.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.2","name":"gitlab-rails-ce-fips-19.2","label":"gitlab-rails-ce-fips-19.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.2","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.3","name":"gitlab-rails-ce-fips-19.3","label":"gitlab-rails-ce-fips-19.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.3","purlType":"apk","versions":[{"text":"< 19.3.3-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.3.3-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.4","name":"gitlab-rails-ce-fips-19.4","label":"gitlab-rails-ce-fips-19.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.4","purlType":"apk","versions":[{"text":"< 19.4.1-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.4.1-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.9-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.9-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-34","name":"nextcloud-server-34","label":"nextcloud-server-34","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-34","purlType":"apk","versions":[{"text":"< 34.0.4-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 34.0.4-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"nextcloud-server-35","name":"nextcloud-server-35","label":"nextcloud-server-35","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/nextcloud-server-35","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin","name":"wazuh-dashboard-alerting-dashboards-plugin","label":"wazuh-dashboard-alerting-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-alerting-dashboards-plugin-fips","name":"wazuh-dashboard-alerting-dashboards-plugin-fips","label":"wazuh-dashboard-alerting-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-alerting-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","name":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","label":"wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-anomaly-detection-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting","name":"wazuh-dashboard-dashboards-reporting","label":"wazuh-dashboard-dashboards-reporting","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-dashboards-reporting-fips","name":"wazuh-dashboard-dashboards-reporting-fips","label":"wazuh-dashboard-dashboards-reporting-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-dashboards-reporting-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin","name":"wazuh-dashboard-index-management-dashboards-plugin","label":"wazuh-dashboard-index-management-dashboards-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-index-management-dashboards-plugin-fips","name":"wazuh-dashboard-index-management-dashboards-plugin-fips","label":"wazuh-dashboard-index-management-dashboards-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-index-management-dashboards-plugin-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-security-plugin","name":"wazuh-dashboard-security-plugin","label":"wazuh-dashboard-security-plugin","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-security-plugin","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"wazuh-dashboard-security-plugin-fips","name":"wazuh-dashboard-security-plugin-fips","label":"wazuh-dashboard-security-plugin-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/wazuh-dashboard-security-plugin-fips","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.14.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.14.9-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"nextcloud-server-33","name":"nextcloud-server-33","label":"nextcloud-server-33","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/nextcloud-server-33","purlType":"apk","versions":[{"text":"< 33.0.9-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 33.0.9-r6","eol":null,"hubHref":null},{"vendor":"browserify","product":"pbkdf2","name":"pbkdf2","label":"pbkdf2","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 3.1.6","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 3.1.6","eol":null,"hubHref":"/vendor/browserify/pbkdf2"},{"vendor":"debian","product":"node-pbkdf2","name":"node-pbkdf2","label":"node-pbkdf2","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/node-pbkdf2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 3.1.7+~3.1.2-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 3.1.7+~3.1.2-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-pbkdf2","name":"node-pbkdf2","label":"node-pbkdf2","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-pbkdf2","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"Npm","product":"pbkdf2","name":"pbkdf2","label":"pbkdf2","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/pbkdf2","purlType":"npm","versions":[{"text":"< 3.1.7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.1.7","eol":null,"hubHref":null}],"affectedCount":42,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx","label":"github.com/browserify/pbkdf2/security/advisories/GHSA-477h-4r7f-fvrx","hostname":"github.com","tags":["Vendor Advisory","REPORT","Advisory","WEB"]},{"url":"https://github.com/browserify/pbkdf2/issues/82","label":"github.com/browserify/pbkdf2/issues/82","hostname":"github.com","tags":["Issue Tracking","REPORT","WEB"]},{"url":"https://github.com/browserify/pbkdf2/commit/493d8d8","label":"github.com/browserify/pbkdf2/commit/493d8d8","hostname":"github.com","tags":["Patch","REPORT","FIX"]},{"url":"https://ubuntu.com/security/CVE-2026-102414","label":"ubuntu.com/security/CVE-2026-102414","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-102414","label":"www.cve.org/CVERecord?id=CVE-2026-102414","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-102414","label":"security-tracker.debian.org/tracker/CVE-2026-102414","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://www.npmjs.com","label":"www.npmjs.com","hostname":"www.npmjs.com","tags":["WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102414.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/102xxx/CVE-2026-102414.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102414","label":"nvd.nist.gov/vuln/detail/CVE-2026-102414","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/browserify/pbkdf2","label":"github.com/browserify/pbkdf2","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://github.com/browserify/pbkdf2/commit/493d8d8ff437f680338bf7397398fda884ad462e","label":"github.com/browserify/pbkdf2/commit/493d8d8ff437f680338bf7397398fda884ad462e","hostname":"github.com","tags":["WEB"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-29T03:42:04.950Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-30T15:17:17.598Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T14:37:16.045Z","stale":false,"partial":false}}