{"schemaVersion":3,"id":"CVE-2026-107386","aliases":["DEBIAN-CVE-2026-107386","CGA-25pf-pjh2-7jmw","CGA-45jj-2jxf-rqxj","CGA-54mq-mhj9-ph49","CGA-59c3-36qf-w8j6","CGA-64qg-cf85-7222","CGA-6jjw-r77h-6rq6","CGA-7wjh-h8vh-hjfg","CGA-9q76-g8hp-4555","CGA-9vq3-p8gx-w6ww","CGA-c888-479h-mvv6","CGA-cjqx-wwg9-qpp9","CGA-gp6h-r696-4xg7","CGA-jc24-3gj7-4xw2","CGA-mp77-ggh3-m2mf","CGA-p36r-37p4-rqpg","CGA-p599-2rjc-7q5c","CGA-pg62-h265-6q9g","CGA-qhgr-ffc4-c5j6","CGA-qxj2-6wrw-mgfj","CGA-qxrr-p9vf-j5w6","CGA-rffr-q6fv-3ccv","CGA-rpp9-xgvq-vmr9","CGA-v979-x78v-w28p","CGA-wccj-j6vr-vhw3","GHSA-w6r9-248c-frg8","CGA-272q-qq94-36f9","CGA-2qmp-r67f-5j8g","CGA-2x87-383f-3xj5","CGA-34wv-2r4r-5vj9","CGA-36jw-xf29-fggr","CGA-3q63-r9jv-wq63","CGA-4ggf-22g6-6h7w","CGA-4x7j-7m5h-8c8h","CGA-527r-fc99-phvh","CGA-5475-7p4v-8x29","CGA-56fm-c7hq-mv63","CGA-59rj-784q-gv2p","CGA-5v55-73hm-6jgw","CGA-5vfx-2pm8-24w7","CGA-62jf-9g4j-6q4j","CGA-6hph-rg7q-x38f","CGA-7g3w-833r-398h","CGA-88rg-38mj-q5c9","CGA-8hg4-x333-76v3","CGA-9395-rjqr-qffr","CGA-948m-5jjr-vgxj","CGA-9f49-jj2h-wj33","CGA-fff2-jqvf-7vhj","CGA-h23j-g3q3-xwm9","CGA-hv28-c87w-q6p4","CGA-j3rx-77r2-375r","CGA-j6h8-pmp9-8264","CGA-jp79-7vr8-rxx5","CGA-jv2q-93gv-gff2","CGA-p88g-rpx3-m25j","CGA-pvvv-mp78-79m5","CGA-q34x-p7qg-wpwv","CGA-q9jh-5vr8-cfx7","CGA-r4rq-9h4x-66mq","CGA-r58r-mw3g-4jx3","CGA-r5jq-3r2h-97p5","CGA-wjxp-764f-gvw5","CGA-xhx3-gxrp-76w8","CGA-xphp-fpv3-h2r8","CGA-xx2c-xmmc-23gg","UBUNTU-CVE-2026-107386","GO-2026-6700"],"status":"published","duplicateOf":null,"title":null,"description":"amqp091-go is a Go AMQP 0.9.1 client. From 1.13.0 until 1.14.0, the frame-size mitigation from the prior allocation advisory can be bypassed before connection.tune completes because Connection.maxFrameSize uses zero for both the not-yet-negotiated and negotiated-unlimited states. A malicious or compromised AMQP peer can send a short body-frame header with a large declared payload length, causing ReadFrame and the body-frame parser to allocate attacker-selected memory before the payload is received or the frame's protocol state is rejected. The condition is reachable through public Open even when Config.FrameSize is set to the protocol minimum and can cause severe memory pressure, out-of-memory termination, or loss of the client process before authentication completes. This issue is fixed in version 1.14.0.","dates":{"published":"2026-10-08T18:54:12.465Z","modified":"2026-10-09T15:14:35.548Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.3,"severity":"medium","version":"4.0","versionLabel":"v4.0","source":"CVE.org","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"4.0","versionLabel":"v4.0","source":"CVE.org","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Debian","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Wolfi","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Go","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Chainguard","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true},{"version":"4.0","versionLabel":"v4.0","source":"NVD","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","exploitability":null,"impact":null,"computed":false},{"version":"4.0","versionLabel":"v4.0","source":"OSV · Ubuntu","score":6.3,"severity":"medium","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","exploitability":null,"impact":null,"computed":true}]},"epss":{"probability":0.00493,"percentile":0.41119,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-09T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00493,"percentile":0.41119}],"last30":[{"date":"2026-10-09T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00493,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00493,"percentile":0.41119}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-770","name":"Allocation of Resources Without Limits or Throttling","description":"The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.","type":"weakness","status":"Incomplete","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/770.html"}],"affected":[{"vendor":"chainguard","product":"argo-events","name":"argo-events","label":"argo-events","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/argo-events","purlType":"apk","versions":[{"text":"< 1.9.11-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.11-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"argo-events-fips","name":"argo-events-fips","label":"argo-events-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/argo-events-fips","purlType":"apk","versions":[{"text":"< 1.9.11-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.11-r15","eol":null,"hubHref":null},{"vendor":"chainguard","product":"bento","name":"bento","label":"bento","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/bento","purlType":"apk","versions":[{"text":"< 1.21.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"bento-fips","name":"bento-fips","label":"bento-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/bento-fips","purlType":"apk","versions":[{"text":"< 1.22.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.22.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dapr-daprd-1.15","name":"dapr-daprd-1.15","label":"dapr-daprd-1.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dapr-daprd-1.15","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dapr-daprd-1.16","name":"dapr-daprd-1.16","label":"dapr-daprd-1.16","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dapr-daprd-1.16","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.16.20-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.16.20-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dapr-daprd-fips-1.15","name":"dapr-daprd-fips-1.15","label":"dapr-daprd-fips-1.15","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dapr-daprd-fips-1.15","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dapr-daprd-fips-1.16","name":"dapr-daprd-fips-1.16","label":"dapr-daprd-fips-1.16","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dapr-daprd-fips-1.16","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.16.20-r6","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.16.20-r6","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcosidekick","name":"falcosidekick","label":"falcosidekick","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcosidekick","purlType":"apk","versions":[{"text":"< 2.35.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.35.0-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"falcosidekick-fips","name":"falcosidekick-fips","label":"falcosidekick-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/falcosidekick-fips","purlType":"apk","versions":[{"text":"< 2.35.0-r7","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.35.0-r7","eol":null,"hubHref":null},{"vendor":"chainguard","product":"guac","name":"guac","label":"guac","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/guac","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.1.0-r37","eol":null,"hubHref":null},{"vendor":"chainguard","product":"guacingest","name":"guacingest","label":"guacingest","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/guacingest","purlType":"apk","versions":[{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.0-r37","eol":null,"hubHref":null},{"vendor":"chainguard","product":"guacone","name":"guacone","label":"guacone","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/guacone","purlType":"apk","versions":[{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 1.1.0-r37 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.18","name":"keda-2.18","label":"keda-2.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.18","purlType":"apk","versions":[{"text":"< 2.18.3-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.3-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.18-metrics-apiserver","name":"keda-2.18-metrics-apiserver","label":"keda-2.18-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.18-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.18.3-r22","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.3-r22","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.19","name":"keda-2.19","label":"keda-2.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.19","purlType":"apk","versions":[{"text":"< 2.19.0-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.19-metrics-apiserver","name":"keda-2.19-metrics-apiserver","label":"keda-2.19-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.19-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.19.0-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r34","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.20","name":"keda-2.20","label":"keda-2.20","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.20","purlType":"apk","versions":[{"text":"< 2.20.2-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-2.20-metrics-apiserver","name":"keda-2.20-metrics-apiserver","label":"keda-2.20-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-2.20-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.20.2-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r13","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.18","name":"keda-fips-2.18","label":"keda-fips-2.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.18","purlType":"apk","versions":[{"text":"< 2.18.3-r24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.3-r24","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.18-metrics-apiserver","name":"keda-fips-2.18-metrics-apiserver","label":"keda-fips-2.18-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.18-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.18.3-r24","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.18.3-r24","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.19","name":"keda-fips-2.19","label":"keda-fips-2.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.19","purlType":"apk","versions":[{"text":"< 2.19.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.19-metrics-apiserver","name":"keda-fips-2.19-metrics-apiserver","label":"keda-fips-2.19-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.19-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.19.0-r25","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r25","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.20","name":"keda-fips-2.20","label":"keda-fips-2.20","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.20","purlType":"apk","versions":[{"text":"< 2.20.2-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"keda-fips-2.20-metrics-apiserver","name":"keda-fips-2.20-metrics-apiserver","label":"keda-fips-2.20-metrics-apiserver","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/keda-fips-2.20-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.20.2-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"krakend","name":"krakend","label":"krakend","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/krakend","purlType":"apk","versions":[{"text":"< 3.0.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"krakend-fips","name":"krakend-fips","label":"krakend-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/krakend-fips","purlType":"apk","versions":[{"text":"< 3.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"telegraf-1.37","name":"telegraf-1.37","label":"telegraf-1.37","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/telegraf-1.37","purlType":"apk","versions":[{"text":"< 1.37.3-r33","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.37.3-r33","eol":null,"hubHref":null},{"vendor":"chainguard","product":"telegraf-1.38","name":"telegraf-1.38","label":"telegraf-1.38","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/telegraf-1.38","purlType":"apk","versions":[{"text":"< 1.38.4-r32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.38.4-r32","eol":null,"hubHref":null},{"vendor":"chainguard","product":"telegraf-1.39","name":"telegraf-1.39","label":"telegraf-1.39","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/telegraf-1.39","purlType":"apk","versions":[{"text":"< 1.39.3-r11","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.39.3-r11","eol":null,"hubHref":null},{"vendor":"chainguard","product":"trufflehog","name":"trufflehog","label":"trufflehog","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/trufflehog","purlType":"apk","versions":[{"text":"< 3.99.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.99.2-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"trufflehog-fips","name":"trufflehog-fips","label":"trufflehog-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/trufflehog-fips","purlType":"apk","versions":[{"text":"< 3.99.2-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.99.2-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"argo-events","name":"argo-events","label":"argo-events","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/argo-events","purlType":"apk","versions":[{"text":"< 1.9.11-r15","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.9.11-r15","eol":null,"hubHref":null},{"vendor":"wolfi","product":"bento","name":"bento","label":"bento","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/bento","purlType":"apk","versions":[{"text":"< 1.21.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.21.2-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"falcosidekick","name":"falcosidekick","label":"falcosidekick","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/falcosidekick","purlType":"apk","versions":[{"text":"< 2.35.0-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.35.0-r8","eol":null,"hubHref":null},{"vendor":"wolfi","product":"guac","name":"guac","label":"guac","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/guac","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.1.0-r37","eol":null,"hubHref":null},{"vendor":"wolfi","product":"guacingest","name":"guacingest","label":"guacingest","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/guacingest","purlType":"apk","versions":[{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.0-r37","eol":null,"hubHref":null},{"vendor":"wolfi","product":"guacone","name":"guacone","label":"guacone","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/guacone","purlType":"apk","versions":[{"text":"< 1.1.0-r37","noFixRecorded":false,"fixedIn":null},{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"< 1.1.0-r37 | All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keda-2.19","name":"keda-2.19","label":"keda-2.19","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keda-2.19","purlType":"apk","versions":[{"text":"< 2.19.0-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r34","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keda-2.19-metrics-apiserver","name":"keda-2.19-metrics-apiserver","label":"keda-2.19-metrics-apiserver","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keda-2.19-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.19.0-r34","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.19.0-r34","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keda-2.20","name":"keda-2.20","label":"keda-2.20","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keda-2.20","purlType":"apk","versions":[{"text":"< 2.20.2-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r13","eol":null,"hubHref":null},{"vendor":"wolfi","product":"keda-2.20-metrics-apiserver","name":"keda-2.20-metrics-apiserver","label":"keda-2.20-metrics-apiserver","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/keda-2.20-metrics-apiserver","purlType":"apk","versions":[{"text":"< 2.20.2-r13","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.20.2-r13","eol":null,"hubHref":null},{"vendor":"wolfi","product":"telegraf-1.38","name":"telegraf-1.38","label":"telegraf-1.38","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/telegraf-1.38","purlType":"apk","versions":[{"text":"< 1.38.4-r32","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.38.4-r32","eol":null,"hubHref":null},{"vendor":"wolfi","product":"trufflehog","name":"trufflehog","label":"trufflehog","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/trufflehog","purlType":"apk","versions":[{"text":"< 3.99.2-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.99.2-r2","eol":null,"hubHref":null},{"vendor":"debian","product":"golang-github-rabbitmq-amqp091-go","name":"golang-github-rabbitmq-amqp091-go","label":"golang-github-rabbitmq-amqp091-go","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/golang-github-rabbitmq-amqp091-go","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 1.14.0-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 1.14.0-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"golang-github-rabbitmq-amqp091-go","name":"golang-github-rabbitmq-amqp091-go","label":"golang-github-rabbitmq-amqp091-go","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/golang-github-rabbitmq-amqp091-go","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"github.com/rabbitmq","product":"amqp091-go","name":"github.com/rabbitmq/amqp091-go","label":"amqp091-go","ecosystem":"Go","cpePart":null,"purl":"pkg:golang/github.com/rabbitmq/amqp091-go","purlType":"golang","versions":[{"text":"< 1.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.14.0","eol":null,"hubHref":null},{"vendor":"rabbitmq","product":"amqp091-go","name":"amqp091-go","label":"amqp091-go","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 1.13.0, < 1.14.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 1.13.0, < 1.14.0","eol":null,"hubHref":"/vendor/rabbitmq/amqp091-go"}],"affectedCount":48,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8","label":"github.com/rabbitmq/amqp091-go/security/advisories/GHSA-w6r9-248c-frg8","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB","REPORT"]},{"url":"https://github.com/rabbitmq/amqp091-go/pull/377","label":"github.com/rabbitmq/amqp091-go/pull/377","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","REPORT"]},{"url":"https://github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3","label":"github.com/rabbitmq/amqp091-go/commit/6723e8cff8710f0a6bf5fb4af375e285052535b3","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB","REPORT"]},{"url":"https://github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0","label":"github.com/rabbitmq/amqp091-go/releases/tag/v1.14.0","hostname":"github.com","tags":["X Refsource MISC","WEB","REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-107386","label":"security-tracker.debian.org/tracker/CVE-2026-107386","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107386.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/107xxx/CVE-2026-107386.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107386","label":"nvd.nist.gov/vuln/detail/CVE-2026-107386","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/rabbitmq/amqp091-go","label":"github.com/rabbitmq/amqp091-go","hostname":"github.com","tags":["PACKAGE"]},{"url":"https://ubuntu.com/security/CVE-2026-107386","label":"ubuntu.com/security/CVE-2026-107386","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-107386","label":"www.cve.org/CVERecord?id=CVE-2026-107386","hostname":"www.cve.org","tags":["REPORT"]}],"lineage":{"upstream":[],"downstream":["RHSA-2026:80217"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-08T18:54:12.465Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-09T15:14:35.548Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T11:00:03.733Z","stale":false,"partial":false}}