{"uuid": "6a9ff5bd-7f33-4181-a280-9fe7ba40e452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-cvxm-645q-p574", "type": "seen", "source": "https://gist.github.com/cwayne18/f47690bfa6aef6e901eb661447319fe1", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/k3s:v1.36.3-k3s1 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH --llm --llm-command \"gh copilot\" --mine-advisories --triage\nLLM overlay: asking command gh\nExtracting docker.io/rancher/k3s:v1.36.3-k3s1 (linux/amd64)...\nScanning for Go binaries...\nFound 4 Go binaries.\nResolving advisories for 457 components (457 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1090 products indexed\nVEX hub https://github.com/rancher/vexhub: 16 finding(s) already covered by a published statement\nTriaging 18 findings against EPSS and CISA KEV (16 CVE ids)\nvexscan report (image) for docker.io/rancher/k3s:v1.36.3-k3s1\nNOTE: --severity CRITICAL,HIGH withheld 34 of 52 findings:\n      21 unknown (no rating was published), 13 medium\nNOTE: --triage could not score 2 of 18 findings, so they sort last for lack of data rather than lack of risk:\n      2 carry no CVE id, which is the only key either feed has\n\n  golang   Go                        457 components    18 findings\n  affected by severity: 2 high\n  2 affected: 1 unique advisories, 2 fixable, 0 with no fix yet\n  already vexed: 5 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 0 scored, 2 unscored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n\nAFFECTED (2) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE                 VERSION  FIXED IN  BASIS\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.80.0  1.82.1\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.79.3  1.82.1\n\nALREADY VEXED (5) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY             PACKAGE                              VERSION                       FIXED IN  EPSS   VEX STATUS    JUSTIFICATION\nHIGH      GHSA-x744-4wpc-v9h2  github.com/docker/docker             v25.0.15-0.20260325154711-d\u2026  29.3.1    95.2%  not_affected  vulnerable_code_not_in_execute_path\nHIGH      GHSA-33vj-92qq-66hc  github.com/containerd/containerd/v2  v2.3.2-k3s2                   2.3.2     27.3%  not_affected  vulnerable_code_not_present\nCRITICAL  GHSA-cvxm-645q-p574  github.com/containerd/containerd/v2  v2.3.2-k3s2                   2.3.2     25.8%  not_affected  vulnerable_code_not_present\nHIGH      GHSA-rgh6-rfwx-v388  github.com/containerd/containerd/v2  v2.3.2-k3s2                   2.3.2     8.5%   not_affected  vulnerable_code_not_present\nHIGH      GHSA-xhf5-7wjv-pqxp  github.com/containerd/containerd/v2  v2.3.2-k3s2                   2.3.2     7.3%   not_affected  vulnerable_code_not_present\n\nRULED OUT (11) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION                       FIXED IN  EPSS   BASIS\nCRITICAL  GO-2026-5017  golang.org/x/crypto       v0.47.0                       0.52.0    46.4%  pclntab\nCRITICAL  GO-2026-5006  golang.org/x/crypto       v0.47.0                       0.52.0    45.4%  pclntab\nCRITICAL  GO-2026-5021  golang.org/x/crypto       v0.47.0                       0.52.0    43.9%  pclntab\nCRITICAL  GO-2026-5020  golang.org/x/crypto       v0.47.0                       0.52.0    41.6%  pclntab\nCRITICAL  GO-2026-5023  golang.org/x/crypto       v0.47.0                       0.52.0    40.3%  pclntab\nHIGH      GO-2026-5013  golang.org/x/crypto       v0.47.0                       0.52.0    38.4%  pclntab\nHIGH      GO-2026-5018  golang.org/x/crypto       v0.47.0                       0.52.0    38.0%  pclntab\nCRITICAL  GO-2026-5019  golang.org/x/crypto       v0.47.0                       0.52.0    34.6%  pclntab\nCRITICAL  GO-2026-5005  golang.org/x/crypto       v0.47.0                       0.52.0    33.9%  pclntab\nHIGH      GO-2026-5746  github.com/docker/docker  v25.0.15-0.20260325154711-d\u2026  no fix    5.1%   pclntab\nHIGH      GO-2026-5617  github.com/docker/docker  v25.0.15-0.20260325154711-d\u2026  no fix    1.2%   pclntab\n\nNOTE: --severity CRITICAL,HIGH withheld 34 of 52 findings:\n      21 unknown (no rating was published), 13 medium\nNOTE: --triage could not score 2 of 18 findings, so they sort last for lack of data rather than lack of risk:\n      2 carry no CVE id, which is the only key either feed has\n  golang   Go                        457 components    18 findings\n  affected by severity: 2 high\n  2 affected: 1 unique advisories, 2 fixable, 0 with no fix yet\n  already vexed: 5 by Rancher Security team\n  priority: none in CISA's known-exploited catalog, 0 at or above the 90th EPSS percentile, 0 scored, 2 unscored\n  priority data: EPSS 2026-08-05, KEV catalog 2026.08.05\n  18 findings in 3 section(s): AFFECTED (2), ALREADY VEXED (5), RULED OUT (11)", "creation_timestamp": "2026-08-05T21:55:34.157953Z"}