{"uuid": "a241a799-a07f-40be-a6b8-8e93e49c9ac9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-xhf5-7wjv-pqxp", "type": "seen", "source": "https://gist.github.com/cwayne18/b5c32c67446c8ec50f54ec955ba4ef5b", "content": "cwayne@geeko ~ % vexscan --image docker.io/rancher/k3s:v1.36.3-k3s1 --all --vexhub https://github.com/rancher/vexhub --severity CRITICAL,HIGH\nExtracting docker.io/rancher/k3s:v1.36.3-k3s1 (linux/amd64)...\nScanning for Go binaries...\nFound 4 Go binaries.\nResolving advisories for 457 components (457 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1086 products indexed\nVEX hub https://github.com/rancher/vexhub: 16 finding(s) already covered by a published statement\nvexscan report (image) for docker.io/rancher/k3s:v1.36.3-k3s1\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n      20 unknown (no rating was published), 14 medium\n\n  golang   Go                        457 components    19 findings\n  affected by severity: 3 high\n  already vexed: 5 by Rancher Security team\n\nAFFECTED (3) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY             PACKAGE                 VERSION  BASIS\nHIGH      GHSA-m4hf-6vgr-75r2  github.com/k3s-io/k3s   (devel)\nHIGH      GO-2026-6061         google.golang.org/grpc  v1.80.0\nHIGH      GO-2026-6061         google.golang.org/grpc  v1.79.3\n\nALREADY VEXED (5) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY             PACKAGE                              VERSION                       VEX STATUS    JUSTIFICATION\nCRITICAL  GHSA-cvxm-645q-p574  github.com/containerd/containerd/v2  v2.3.2-k3s2                   not_affected  vulnerable_code_not_present\nHIGH      GHSA-33vj-92qq-66hc  github.com/containerd/containerd/v2  v2.3.2-k3s2                   not_affected  vulnerable_code_not_present\nHIGH      GHSA-rgh6-rfwx-v388  github.com/containerd/containerd/v2  v2.3.2-k3s2                   not_affected  vulnerable_code_not_present\nHIGH      GHSA-xhf5-7wjv-pqxp  github.com/containerd/containerd/v2  v2.3.2-k3s2                   not_affected  vulnerable_code_not_present\nHIGH      GHSA-x744-4wpc-v9h2  github.com/docker/docker             v25.0.15-0.20260325154711-d\u2026  not_affected  vulnerable_code_not_in_execute_path\n\nRULED OUT (11) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY      PACKAGE                   VERSION                       BASIS\nCRITICAL  GO-2026-5005  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5006  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5017  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5019  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5020  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5021  golang.org/x/crypto       v0.47.0                       pclntab\nCRITICAL  GO-2026-5023  golang.org/x/crypto       v0.47.0                       pclntab\nHIGH      GO-2026-5617  github.com/docker/docker  v25.0.15-0.20260325154711-d\u2026  pclntab\nHIGH      GO-2026-5746  github.com/docker/docker  v25.0.15-0.20260325154711-d\u2026  pclntab\nHIGH      GO-2026-5013  golang.org/x/crypto       v0.47.0                       pclntab\nHIGH      GO-2026-5018  golang.org/x/crypto       v0.47.0                       pclntab\n\nNOTE: --severity CRITICAL,HIGH withheld 34 of 53 findings:\n      20 unknown (no rating was published), 14 medium\n  golang   Go                        457 components    19 findings\n  affected by severity: 3 high\n  already vexed: 5 by Rancher Security team\n  19 findings in 3 section(s): AFFECTED (3), ALREADY VEXED (5), RULED OUT (11)", "creation_timestamp": "2026-08-05T12:34:16.537515Z"}