{"schemaVersion":3,"id":"CVE-2026-25128","aliases":["UBUNTU-CVE-2026-25128","CGA-2rx4-3prr-f878","CGA-4xcx-ppf2-8hvm","CGA-69qp-787c-qpqp","CGA-7c2p-22xh-4hmm","CGA-9mjf-2cm9-gmwf","CGA-9v7w-x82c-q462","CGA-9xjj-48rr-96w7","CGA-c9jj-r32f-66x7","CGA-ccmf-gjvx-9gmv","CGA-cwcr-h87m-j3hm","CGA-g6rp-67c9-g7wf","CGA-gwmw-2529-2h48","CGA-h6h5-h4q3-rc34","CGA-hrxq-9qhv-cqmq","CGA-hv4x-gx4x-7wj6","CGA-j2px-p35r-3wxg","CGA-jx7g-w4vg-4j6g","CGA-m7g2-c5q8-hj3w","CGA-m84h-mpvc-86mx","CGA-mp2m-7xg3-wwr3","CGA-pg5v-c5hg-m3q5","CGA-pgf7-483f-qch9","CGA-prg8-q6mw-cwxv","CGA-q78g-6q93-c8h8","CGA-q8mf-qwc5-w8cv","CGA-qcr4-x4fg-vp96","CGA-v3c8-6vc5-w99f","CGA-w37f-625x-28m6","CGA-w5j9-59wh-9pjg","CGA-w5mg-374f-5j5x","CGA-xh2h-935x-6wj2","CGA-xhgr-c85v-7gcg","CGA-xhr8-292c-fmjq","GHSA-37qj-frw5-hhjh","CGA-32mh-5r3f-cpj4","CGA-33wh-64pj-wc3v","CGA-3925-fpv4-4vqr","CGA-3cf4-44mc-qc3c","CGA-3vxr-vf67-37f6","CGA-3x62-r8fw-h9h7","CGA-42j2-2rj9-mwxc","CGA-44hw-32rf-j6vc","CGA-47gj-cp34-rw4p","CGA-48qj-9pmc-p37v","CGA-4p8m-2jp3-rc2v","CGA-6329-285r-x4jp","CGA-6345-7chr-8rm3","CGA-6cc6-3jqh-xwg7","CGA-6m5g-h7v8-hvrv","CGA-6m7m-3jm8-3xgx","CGA-6p2m-2968-49xx","CGA-6x7v-grgh-qhhf","CGA-7fg4-v5h2-fffr","CGA-897g-m2h4-mvg6","CGA-8m3x-264w-r3x4","CGA-8px9-r5p9-5r9w","CGA-92gx-cfp5-4j89","CGA-9f2m-qgx7-hcvj","CGA-9m7p-rcqm-6p55","CGA-9pvr-475g-37jq","CGA-9qfq-8pqj-8j6q","CGA-9x4j-vh5g-p243","CGA-c822-fp63-7f8m","CGA-cm99-h246-7pm5","CGA-f3fh-3xrm-vg34","CGA-f9rv-7g37-7556","CGA-g22v-f2hx-mgqg","CGA-g2f2-hpj9-86p2","CGA-g7jg-37r9-764f","CGA-hjfx-863x-jhhj","CGA-hv64-5rrw-qmmc","CGA-jf3x-c4w7-f624","CGA-jfxq-pqq9-qwgx","CGA-m2hv-cx5h-p4wh","CGA-m4jc-g37x-fqw5","CGA-mmch-3w9x-hwmf","CGA-mpp6-x29q-w5xx","CGA-mqcg-65gw-vwqw","CGA-mrc4-pr7m-629p","CGA-p47c-mvx8-xv2g","CGA-p59h-7v2f-vfg6","CGA-pcc2-qw6r-j2vr","CGA-pf6r-w8wc-85vp","CGA-phrw-rq88-h73w","CGA-pmpm-2vxc-fjjw","CGA-pvj2-r9c9-553p","CGA-q327-825c-m24x","CGA-qgm3-pxmq-9fwj","CGA-qrx3-6x67-7r9g","CGA-rc39-fw5c-g7fq","CGA-rr44-2wx4-jvqv","CGA-rw24-q654-h7hq","CGA-rw7j-7xm4-899m","CGA-rxcx-xj9v-q8wc","CGA-v5wm-6qqm-q5m8","CGA-v9fg-5w8g-x2fr","CGA-vppj-mj48-9m2q","CGA-wwwf-fgjv-3grw","CGA-x33j-696c-v739","CGA-x83x-59j5-5j2v","CGA-xcq2-x2rg-j776","CGA-xjxh-vg43-v3c4"],"status":"published","duplicateOf":null,"title":null,"description":"fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML from JS object without C/C++ based libraries and no callback. In versions 5.0.9 through 5.3.3, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input. Version 5.3.4 fixes the issue.","dates":{"published":"2026-01-30T15:14:58.244Z","modified":"2026-02-11T18:38:40.192Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":7.5,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":10,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.5,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00621,"percentile":0.48801,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0.04000000000000002,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00581},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00568,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00621,"percentile":0.48801}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00581,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00621,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00621,"percentile":0.48801}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"GITHUB_NATURALINTELLIGENCE_FAST-XML-PARSER","name":"Fast Xml Parser","source":"github","url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-mpg4-rc92-vx8v","maturity":"poc","reliabilityScore":0.3,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-20","name":"Improper Input Validation","description":"The product receives input or data, but it does\n        not validate or incorrectly validates that the input has the\n        properties that are required to process the data safely and\n        correctly.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/20.html"},{"id":"CWE-248","name":"Uncaught Exception","description":"An exception is thrown from a function, but it is not caught.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/248.html"}],"affected":[{"vendor":"chainguard","product":"dbgate","name":"dbgate","label":"dbgate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dbgate","purlType":"apk","versions":[{"text":"< 7.0.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.0.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"dbgate-fips","name":"dbgate-fips","label":"dbgate-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/dbgate-fips","purlType":"apk","versions":[{"text":"< 7.0.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 7.0.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"jitsucom-jitsu-console","name":"jitsucom-jitsu-console","label":"jitsucom-jitsu-console","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/jitsucom-jitsu-console","purlType":"apk","versions":[{"text":"< 2.11.0-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.0-r14","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17","name":"kibana-8.17","label":"kibana-8.17","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17","purlType":"apk","versions":[{"text":"< 8.17.10-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.17-iamguarded","name":"kibana-8.17-iamguarded","label":"kibana-8.17-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.17-iamguarded","purlType":"apk","versions":[{"text":"< 8.17.10-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.17.10-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18","name":"kibana-8.18","label":"kibana-8.18","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18","purlType":"apk","versions":[{"text":"< 8.18.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.18.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.18-iamguarded","name":"kibana-8.18-iamguarded","label":"kibana-8.18-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.18-iamguarded","purlType":"apk","versions":[{"text":"< 8.18.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.18.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.10-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.10-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"< 8.19.10-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.10-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0","name":"kibana-9.0","label":"kibana-9.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0","purlType":"apk","versions":[{"text":"< 9.0.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-bitnami","name":"kibana-9.0-bitnami","label":"kibana-9.0-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-bitnami","purlType":"apk","versions":[{"text":"< 9.0.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.0-iamguarded","name":"kibana-9.0-iamguarded","label":"kibana-9.0-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.0-iamguarded","purlType":"apk","versions":[{"text":"< 9.0.8-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.0.8-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1","name":"kibana-9.1","label":"kibana-9.1","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1","purlType":"apk","versions":[{"text":"< 9.1.10-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.1-iamguarded","name":"kibana-9.1-iamguarded","label":"kibana-9.1-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.1-iamguarded","purlType":"apk","versions":[{"text":"< 9.1.10-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.1.10-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2","name":"kibana-9.2","label":"kibana-9.2","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2","purlType":"apk","versions":[{"text":"< 9.2.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.2-iamguarded","name":"kibana-9.2-iamguarded","label":"kibana-9.2-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.2-iamguarded","purlType":"apk","versions":[{"text":"< 9.2.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.2.5-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"< 9.3.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"< 9.3.0-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.3.0-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kubeflow-pipelines-frontend","name":"kubeflow-pipelines-frontend","label":"kubeflow-pipelines-frontend","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kubeflow-pipelines-frontend","purlType":"apk","versions":[{"text":"< 2.15.0-r7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.15.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.0-r7 | < 2.15.0-r10","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-2-worker","name":"langfuse-2-worker","label":"langfuse-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3","purlType":"apk","versions":[{"text":"< 3.150.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.150.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.150.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r2 | < 3.150.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-2-worker","name":"langfuse-fips-2-worker","label":"langfuse-fips-2-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-2-worker","purlType":"apk","versions":[{"text":"< 2.95.12-r9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.95.12-r9","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3","name":"langfuse-fips-3","label":"langfuse-fips-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3","purlType":"apk","versions":[{"text":"< 3.152.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.152.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"langfuse-fips-3-worker","name":"langfuse-fips-3-worker","label":"langfuse-fips-3-worker","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/langfuse-fips-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 3.152.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r1 | < 3.152.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"librechat","name":"librechat","label":"librechat","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/librechat","purlType":"apk","versions":[{"text":"< 0.8.2-r1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.8.2-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 0.8.2-r1 | < 0.8.2-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.4.0-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.4.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0-r3 | < 3.4.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3-fips","name":"opensearch-dashboards-3-fips","label":"opensearch-dashboards-3-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips","purlType":"apk","versions":[{"text":"< 3.4.0-r4","noFixRecorded":false,"fixedIn":null},{"text":"< 3.4.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0-r4 | < 3.4.0-r2","eol":null,"hubHref":null},{"vendor":"chainguard","product":"prism","name":"prism","label":"prism","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/prism","purlType":"apk","versions":[{"text":"< 5.14.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.14.3-r5","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"chainguard","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/renovate","purlType":"apk","versions":[{"text":"< 43.3.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.3.1-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"saf","name":"saf","label":"saf","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r0 | < 1.5.3-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tileserver-gl","name":"tileserver-gl","label":"tileserver-gl","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tileserver-gl","purlType":"apk","versions":[{"text":"< 5.5.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.5.0-r4","eol":null,"hubHref":null},{"vendor":"chainguard","product":"tileserver-gl-fips","name":"tileserver-gl-fips","label":"tileserver-gl-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/tileserver-gl-fips","purlType":"apk","versions":[{"text":"< 5.5.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.5.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"jitsucom-jitsu-console","name":"jitsucom-jitsu-console","label":"jitsucom-jitsu-console","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/jitsucom-jitsu-console","purlType":"apk","versions":[{"text":"< 2.11.0-r14","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.11.0-r14","eol":null,"hubHref":null},{"vendor":"wolfi","product":"kubeflow-pipelines-frontend","name":"kubeflow-pipelines-frontend","label":"kubeflow-pipelines-frontend","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/kubeflow-pipelines-frontend","purlType":"apk","versions":[{"text":"< 2.15.0-r7","noFixRecorded":false,"fixedIn":null},{"text":"< 2.15.0-r10","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 2.15.0-r7 | < 2.15.0-r10","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3","name":"langfuse-3","label":"langfuse-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3","purlType":"apk","versions":[{"text":"< 3.150.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.150.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"langfuse-3-worker","name":"langfuse-3-worker","label":"langfuse-3-worker","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/langfuse-3-worker","purlType":"apk","versions":[{"text":"< 3.153.0-r2","noFixRecorded":false,"fixedIn":null},{"text":"< 3.150.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.153.0-r2 | < 3.150.0-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.4.0-r3","noFixRecorded":false,"fixedIn":null},{"text":"< 3.4.0-r2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.4.0-r3 | < 3.4.0-r2","eol":null,"hubHref":null},{"vendor":"wolfi","product":"prism","name":"prism","label":"prism","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/prism","purlType":"apk","versions":[{"text":"< 5.14.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.14.3-r5","eol":{"isEol":null,"eolDate":null,"matchMethod":"alias_exact","cycle":null,"product":{"name":"nutanix-prism","label":"Nutanix Prism Central","category":"server-app"}},"hubHref":null},{"vendor":"wolfi","product":"renovate","name":"renovate","label":"renovate","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/renovate","purlType":"apk","versions":[{"text":"< 43.3.1-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 43.3.1-r0","eol":null,"hubHref":null},{"vendor":"wolfi","product":"saf","name":"saf","label":"saf","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/saf","purlType":"apk","versions":[{"text":"< 1.6.0-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.3-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.0-r0 | < 1.5.3-r1","eol":null,"hubHref":null},{"vendor":"wolfi","product":"tileserver-gl","name":"tileserver-gl","label":"tileserver-gl","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/tileserver-gl","purlType":"apk","versions":[{"text":"< 5.5.0-r4","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 5.5.0-r4","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"node-webfont","name":"node-webfont","label":"node-webfont","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/node-webfont","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"naturalintelligence","product":"fast-xml-parser","name":"fast-xml-parser","label":"fast-xml-parser","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 5.0.9, ≤ 5.3.3","noFixRecorded":false,"fixedIn":null},{"text":"≥ 5.0.9, < 5.3.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.0.9, ≤ 5.3.3 | ≥ 5.0.9, < 5.3.4","eol":null,"hubHref":"/vendor/naturalintelligence/fast-xml-parser"},{"vendor":"Npm","product":"fast-xml-parser","name":"fast-xml-parser","label":"fast-xml-parser","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/fast-xml-parser","purlType":"npm","versions":[{"text":"≥ 5.0.9, < 5.3.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 5.0.9, < 5.3.4","eol":null,"hubHref":null}],"affectedCount":45,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh","label":"github.com/NaturalIntelligence/fast-xml-parser/security/advisories/GHSA-37qj-frw5-hhjh","hostname":"github.com","tags":["X Refsource CONFIRM","REPORT","Advisory","WEB","Exploit","Vendor Advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc","label":"github.com/NaturalIntelligence/fast-xml-parser/commit/4e387f61c4a5cef792f6a2f42467013290bf95dc","hostname":"github.com","tags":["X Refsource MISC","REPORT","FIX","WEB","Patch"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4","label":"github.com/NaturalIntelligence/fast-xml-parser/releases/tag/v5.3.4","hostname":"github.com","tags":["X Refsource MISC","REPORT","WEB","Release Notes"]},{"url":"https://ubuntu.com/security/CVE-2026-25128","label":"ubuntu.com/security/CVE-2026-25128","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-25128","label":"www.cve.org/CVERecord?id=CVE-2026-25128","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25128.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25128.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25128","label":"nvd.nist.gov/vuln/detail/CVE-2026-25128","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/NaturalIntelligence/fast-xml-parser","label":"github.com/NaturalIntelligence/fast-xml-parser","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2026:11126-1"],"duplicates":[],"related":["CGA-6FX2-CVG4-R922","OPENSUSE-SU-2026:11126-1"]},"timeline":[{"kind":"published","date":"2026-01-30T15:14:58.244Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-02-11T18:38:40.192Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":40,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T14:47:30.686Z","stale":false,"partial":false}}