data/reports: add 4 reports - data/reports/GO-2026-4942.yaml - data/reports/GO-2026-4950.yaml - data/reports/GO-2026-6216.yaml - data/reports/GO-2026-6225.yaml Fixes golang/vulndb#4942 Fixes golang/vulndb#4950 Fixes golang/vulndb#6216 Fixes golang/vulndb#6225 Change-Id: I48561c593aa97fe5122054f2cf6babe9b141860f Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/817021 LUCI-TryBot-Result: golang-scoped@luci-project-accounts.iam.gserviceaccount.com <golang-scoped@luci-project-accounts.iam.gserviceaccount.com> Auto-Submit: Ian Alexander <jitsu@google.com> Reviewed-by: Ethan Lee <ethanalee@google.com>
diff --git a/data/osv/GO-2026-4942.json b/data/osv/GO-2026-4942.json new file mode 100644 index 0000000..c8f18db --- /dev/null +++ b/data/osv/GO-2026-4942.json
@@ -0,0 +1,92 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-4942", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "aliases": [ + "CVE-2026-35172", + "GHSA-f2g3-hh2r-cwgc" + ], + "summary": "Stale blob descriptor cache invalidation in github.com/distribution/distribution", + "details": "In github.com/distribution/distribution and github.com/distribution/distribution/v3 before 3.1.0, when storage.cache.blobdescriptor is configured with redis and storage.delete.enabled is true, deleting a blob in one repository clears the shared digest descriptor in Redis but leaves stale repository-scoped membership behind. If another repository subsequently requests or stats the same digest, the shared descriptor is repopulated and the deleted blob becomes accessible again in the first repository.", + "affected": [ + { + "package": { + "name": "github.com/distribution/distribution", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/distribution/distribution/registry/storage/cache/redis", + "symbols": [ + "repositoryScopedRedisBlobDescriptorService.Clear" + ] + } + ] + } + }, + { + "package": { + "name": "github.com/distribution/distribution/v3", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "3.1.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/distribution/distribution/v3/registry/storage/cache/redis", + "symbols": [ + "repositoryScopedRedisBlobDescriptorService.Clear" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc" + }, + { + "type": "FIX", + "url": "https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d" + }, + { + "type": "REPORT", + "url": "https://github.com/golang/vulndb/issues/4942" + } + ], + "credits": [ + { + "name": "Oleh Konko (GitHub: 1seal)" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-4942", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-4950.json b/data/osv/GO-2026-4950.json new file mode 100644 index 0000000..c41b6da --- /dev/null +++ b/data/osv/GO-2026-4950.json
@@ -0,0 +1,72 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-4950", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "summary": "Authorization bypass via double-encoded paths in github.com/valyala/fasthttp", + "details": "In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS reinterpret filesystem paths as URIs, decoding percent-encoded sequences and treating characters like '?' and '#' as URI delimiters. In applications where authorization guards inspect ctx.Path() before passing paths to file-serving handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass access controls while still resolving to the protected file on disk.", + "affected": [ + { + "package": { + "name": "github.com/valyala/fasthttp", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.70.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/valyala/fasthttp", + "symbols": [ + "RequestCtx.SendFile", + "RequestCtx.SendFileBytes", + "ServeFS", + "ServeFile", + "ServeFileBytes", + "ServeFileBytesUncompressed", + "ServeFileUncompressed" + ] + } + ] + } + } + ], + "references": [ + { + "type": "REPORT", + "url": "https://github.com/golang/vulndb/issues/4950" + }, + { + "type": "FIX", + "url": "https://github.com/valyala/fasthttp/pull/2163" + }, + { + "type": "WEB", + "url": "https://gist.github.com/thesmartshadow/af53acdfe0d6ce352d14eb86cecf5a08" + }, + { + "type": "WEB", + "url": "https://github.com/valyala/fasthttp/releases/tag/v1.70.0" + } + ], + "credits": [ + { + "name": "Ali Firas (thesmartshadow)" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-4950", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6216.json b/data/osv/GO-2026-6216.json new file mode 100644 index 0000000..05529fb --- /dev/null +++ b/data/osv/GO-2026-6216.json
@@ -0,0 +1,68 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6216", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "summary": "Cross-forge account takeover on login in codefloe.com/crowci/crow/v6", + "details": "In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during forge login is not scoped to the authenticating forge. An account on one forge matches an existing user on another forge via forge remote ID collision or username collision. On instances with multiple configured forges, an attacker can take over arbitrary Crow accounts by registering matching credentials on any connected forge.", + "affected": [ + { + "package": { + "name": "codefloe.com/crowci/crow/v6", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "6.4.0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "codefloe.com/crowci/crow/v6/server/api", + "symbols": [ + "HandleAuth" + ] + }, + { + "path": "codefloe.com/crowci/crow/v6/server/store/datastore", + "symbols": [ + "storage.GetUserRemoteID" + ] + } + ] + } + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://codefloe.com/crowci/crow/src/branch/main/security/advisories/cross-forge-account-takeover.md" + }, + { + "type": "FIX", + "url": "https://codefloe.com/crowci/crow/commit/6b4405f1ef0126e5074383e551ae38d55c2a7efe" + }, + { + "type": "WEB", + "url": "https://codefloe.com/crowci/crow/releases/tag/v6.4.0" + } + ], + "credits": [ + { + "name": "Cassandra Beelen (sapphiccode)" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6216", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/osv/GO-2026-6225.json b/data/osv/GO-2026-6225.json new file mode 100644 index 0000000..0c243d9 --- /dev/null +++ b/data/osv/GO-2026-6225.json
@@ -0,0 +1,51 @@ +{ + "schema_version": "1.3.1", + "id": "GO-2026-6225", + "modified": "0001-01-01T00:00:00Z", + "published": "0001-01-01T00:00:00Z", + "summary": "Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env", + "details": "In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the regular expression used by isACRRegistry to validate Azure Container Registry hostnames is unanchored. As a result, arbitrary hostnames containing the substring \".azurecr.io\" (such as evil.azurecr.io.attacker.com) are treated as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active Directory (AAD) access token to attacker-controlled hosts.", + "affected": [ + { + "package": { + "name": "github.com/chrismellard/docker-credential-acr-env", + "ecosystem": "Go" + }, + "ranges": [ + { + "type": "SEMVER", + "events": [ + { + "introduced": "0" + } + ] + } + ], + "ecosystem_specific": { + "imports": [ + { + "path": "github.com/chrismellard/docker-credential-acr-env/pkg/credhelper", + "symbols": [ + "ACRCredHelper.Get", + "isACRRegistry" + ] + } + ] + } + } + ], + "references": [ + { + "type": "REPORT", + "url": "https://github.com/chrismellard/docker-credential-acr-env/issues/21" + }, + { + "type": "WEB", + "url": "https://github.com/osscontainertools/docker-credential-acr" + } + ], + "database_specific": { + "url": "https://pkg.go.dev/vuln/GO-2026-6225", + "review_status": "REVIEWED" + } +} \ No newline at end of file
diff --git a/data/reports/GO-2026-4942.yaml b/data/reports/GO-2026-4942.yaml new file mode 100644 index 0000000..5f00a28 --- /dev/null +++ b/data/reports/GO-2026-4942.yaml
@@ -0,0 +1,40 @@ +id: GO-2026-4942 +modules: + - module: github.com/distribution/distribution + vulnerable_at: 2.8.3+incompatible + packages: + - package: github.com/distribution/distribution/registry/storage/cache/redis + symbols: + - repositoryScopedRedisBlobDescriptorService.Clear + - module: github.com/distribution/distribution/v3 + versions: + - fixed: 3.1.0 + vulnerable_at: 3.0.0 + packages: + - package: github.com/distribution/distribution/v3/registry/storage/cache/redis + symbols: + - repositoryScopedRedisBlobDescriptorService.Clear +summary: Stale blob descriptor cache invalidation in github.com/distribution/distribution +description: |- + In github.com/distribution/distribution and + github.com/distribution/distribution/v3 before 3.1.0, when + storage.cache.blobdescriptor is configured with redis and storage.delete.enabled + is true, deleting a blob in one repository clears the shared digest descriptor + in Redis but leaves stale repository-scoped membership behind. If another + repository subsequently requests or stats the same digest, the shared descriptor + is repopulated and the deleted blob becomes accessible again in the first + repository. +cves: + - CVE-2026-35172 +ghsas: + - GHSA-f2g3-hh2r-cwgc +credits: + - 'Oleh Konko (GitHub: 1seal)' +references: + - advisory: https://github.com/distribution/distribution/security/advisories/GHSA-f2g3-hh2r-cwgc + - fix: https://github.com/distribution/distribution/commit/078b0783f239b4115d1a979e66f08832084e9d1d + - report: https://github.com/golang/vulndb/issues/4942 +source: + id: GHSA-f2g3-hh2r-cwgc + created: 2026-08-17T23:18:58.23176-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-4950.yaml b/data/reports/GO-2026-4950.yaml new file mode 100644 index 0000000..4d77b48 --- /dev/null +++ b/data/reports/GO-2026-4950.yaml
@@ -0,0 +1,36 @@ +id: GO-2026-4950 +modules: + - module: github.com/valyala/fasthttp + versions: + - fixed: 1.70.0 + vulnerable_at: 1.69.0 + packages: + - package: github.com/valyala/fasthttp + symbols: + - ServeFile + - ServeFS + - RequestCtx.SendFile + derived_symbols: + - RequestCtx.SendFileBytes + - ServeFileBytes + - ServeFileBytesUncompressed + - ServeFileUncompressed +summary: Authorization bypass via double-encoded paths in github.com/valyala/fasthttp +description: |- + In github.com/valyala/fasthttp before 1.70.0, ServeFile and ServeFS + reinterpret filesystem paths as URIs, decoding percent-encoded sequences and + treating characters like '?' and '#' as URI delimiters. In applications where + authorization guards inspect ctx.Path() before passing paths to file-serving + handlers, double-encoded path variants (e.g., /%2561dmin/export.csv) bypass + access controls while still resolving to the protected file on disk. +credits: + - Ali Firas (thesmartshadow) +references: + - report: https://github.com/golang/vulndb/issues/4950 + - fix: https://github.com/valyala/fasthttp/pull/2163 + - web: https://gist.github.com/thesmartshadow/af53acdfe0d6ce352d14eb86cecf5a08 + - web: https://github.com/valyala/fasthttp/releases/tag/v1.70.0 +source: + id: go-security-team + created: 2026-08-17T23:18:56.603555-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-6216.yaml b/data/reports/GO-2026-6216.yaml new file mode 100644 index 0000000..a99e908 --- /dev/null +++ b/data/reports/GO-2026-6216.yaml
@@ -0,0 +1,31 @@ +id: GO-2026-6216 +modules: + - module: codefloe.com/crowci/crow/v6 + versions: + - fixed: 6.4.0 + vulnerable_at: 6.3.0 + packages: + - package: codefloe.com/crowci/crow/v6/server/api + symbols: + - HandleAuth + - package: codefloe.com/crowci/crow/v6/server/store/datastore + symbols: + - storage.GetUserRemoteID +summary: Cross-forge account takeover on login in codefloe.com/crowci/crow/v6 +description: |- + In codefloe.com/crowci/crow/v6 before 6.4.0, user account lookup during + forge login is not scoped to the authenticating forge. An account on one forge + matches an existing user on another forge via forge remote ID collision or + username collision. On instances with multiple configured forges, an attacker + can take over arbitrary Crow accounts by registering matching credentials on + any connected forge. +credits: + - Cassandra Beelen (sapphiccode) +references: + - advisory: https://codefloe.com/crowci/crow/src/branch/main/security/advisories/cross-forge-account-takeover.md + - fix: https://codefloe.com/crowci/crow/commit/6b4405f1ef0126e5074383e551ae38d55c2a7efe + - web: https://codefloe.com/crowci/crow/releases/tag/v6.4.0 +source: + id: go-security-team + created: 2026-08-17T22:57:59.849446-04:00 +review_status: REVIEWED
diff --git a/data/reports/GO-2026-6225.yaml b/data/reports/GO-2026-6225.yaml new file mode 100644 index 0000000..800a5af --- /dev/null +++ b/data/reports/GO-2026-6225.yaml
@@ -0,0 +1,24 @@ +id: GO-2026-6225 +modules: + - module: github.com/chrismellard/docker-credential-acr-env + vulnerable_at: 0.0.0-20230304212654-82a0ddb27589 + packages: + - package: github.com/chrismellard/docker-credential-acr-env/pkg/credhelper + symbols: + - isACRRegistry + - ACRCredHelper.Get +summary: Credential leakage to untrusted hosts in github.com/chrismellard/docker-credential-acr-env +description: |- + In github.com/chrismellard/docker-credential-acr-env/pkg/credhelper, the + regular expression used by isACRRegistry to validate Azure Container + Registry hostnames is unanchored. As a result, arbitrary hostnames containing + the substring ".azurecr.io" (such as evil.azurecr.io.attacker.com) are treated + as valid ACR registries, causing ACRCredHelper.Get to send the Azure Active + Directory (AAD) access token to attacker-controlled hosts. +references: + - report: https://github.com/chrismellard/docker-credential-acr-env/issues/21 + - web: https://github.com/osscontainertools/docker-credential-acr +source: + id: go-security-team + created: 2026-08-17T22:53:28.910676-04:00 +review_status: REVIEWED