{
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:da3ba61e-7740-4d5f-bc72-356ae7184955",
  "version": 1,
  "metadata": {
    "timestamp": "2026-10-13T08:57:23.353472+00:00",
    "component": {
      "type": "application",
      "name": "sbomify v26.9.0",
      "bom-ref": "release-MGQ2mrDy1K8p"
    }
  },
  "components": [
    {
      "bom-ref": "pkg:pypi/pip@26.1.2",
      "type": "library",
      "name": "pip",
      "version": "26.1.2",
      "purl": "pkg:pypi/pip@26.1.2",
      "scope": "excluded",
      "description": "Present only as an unextracted wheel at /usr/share/python-wheels/pip-26.1.2-py3-none-any.whl, inherited from the Chainguard base image. Not installed, not importable, not executable by the runtime user."
    },
    {
      "bom-ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3",
      "type": "application",
      "name": "cosign",
      "version": "v3.1.3",
      "purl": "pkg:golang/github.com/sigstore/cosign@v3.1.3",
      "description": "The identity as published in this tag's SBOM. The module path is missing its Go major version suffix, which is what causes the six false advisory matches. Retained here verbatim so this VEX matches the finding as a scanner reports it."
    },
    {
      "bom-ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3",
      "type": "application",
      "name": "cosign",
      "version": "v3.1.3",
      "purl": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3",
      "description": "The correct Go module path for cosign v3.1.3, confirmed against go.mod at that tag. Emitted by sbomify PR #1519 onward. Included so this VEX keeps matching once the SBOM is regenerated."
    },
    {
      "bom-ref": "pkg:npm/fast-uri@3.1.5",
      "type": "library",
      "name": "fast-uri",
      "version": "3.1.5",
      "purl": "pkg:npm/fast-uri@3.1.5",
      "scope": "excluded",
      "description": "Present in the build-time dependency graph only. Reached solely through ajv 8.20.0, which is pulled in by workbox-build 7.4.1 and @apideck/better-ajv-errors 0.3.7 under vite-plugin-pwa 1.3.0. Not bundled into any shipped artifact."
    }
  ],
  "vulnerabilities": [
    {
      "bom-ref": "vuln-cve-2026-13346",
      "id": "CVE-2026-13346",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13346"
      },
      "references": [
        {
          "id": "GHSA-qwm4-qh6w-59xr",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-qwm4-qh6w-59xr"
          }
        },
        {
          "id": "PYSEC-2026-3721",
          "source": {
            "name": "PyPI Advisory Database",
            "url": "https://osv.dev/vulnerability/PYSEC-2026-3721"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-qwm4-qh6w-59xr"
          },
          "severity": "high",
          "score": 7.5
        }
      ],
      "description": "pip would incorrectly handle doubly-encoded package URLs from indexes, allowing files to be installed to arbitrary locations on disk. Fixed in pip 26.2.0.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:pypi/pip@26.1.2"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "pip 26.1.2 is present in the image but is not installed and cannot execute.\n\nVerified by inspecting ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f).\n\n1. Form on disk. pip exists only as an unextracted wheel archive at /usr/share/python-wheels/pip-26.1.2-py3-none-any.whl, 1814110 bytes, owned root:root, mode 0644. It is inherited from the pinned base image cgr.dev/chainguard/python@sha256:33334c2bf93fd99e6b3c42b518cc44bb5277a954826cdb4f9275ef95818d7eb7, which ships the same file. Nothing in the build extracts or installs it.\n\n2. Not importable. Inside the running image, importlib.util.find_spec(\"pip\") returns None. setuptools resolves from the virtualenv, pip and wheel do not. The stdlib ensurepip module reports _PIP_VERSION 26.1.2, which records the bundled wheel rather than an installation.\n\n3. Not installable by the runtime user. The container runs as UID 65532 (nonroot). The virtualenv site-packages directory is not writable by that user, and the production image is distroless with no shell.\n\n4. Never invoked. No application source calls pip. Python dependencies are installed with uv, at build time, in a separate stage that does not contribute to the runtime filesystem.\n\nCVE-2026-13346 requires pip to resolve and install a package from an index. Reaching that state from this image requires arbitrary code execution first, then installing pip from the wheel into a writable location, then pointing it at a hostile index. The first step already exceeds what this vulnerability grants.\n\nScope and remediation. This describes the image at the stated digest. The fix is not in the sbomify repository: the wheel comes from the base image, and a distroless stage cannot remove it because it has no shell and permits no RUN instruction. It clears when Chainguard publishes a base carrying pip 26.2.0 or later and CHAINGUARD_PYTHON_IMAGE in the Dockerfile is bumped to that digest.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2023-46737",
      "id": "CVE-2023-46737",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46737"
      },
      "references": [
        {
          "id": "GHSA-vfp6-jrw2-99g9",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-vfp6-jrw2-99g9"
          }
        },
        {
          "id": "GO-2023-2181",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2023-2181"
          }
        },
        {
          "id": "BIT-cosign-2023-46737",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2023-46737"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-vfp6-jrw2-99g9"
          },
          "severity": "medium"
        }
      ],
      "description": "Denial of service attack from remote registry in github.com/sigstore/cosign.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.1, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nIndependently of version, this code path is not exercised: sbomify never has cosign contact a container registry. The only invocation is `cosign verify-blob-attestation` against a local bundle file.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2024-29902",
      "id": "CVE-2024-29902",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29902"
      },
      "references": [
        {
          "id": "GHSA-88jx-383q-w4qc",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-88jx-383q-w4qc"
          }
        },
        {
          "id": "GO-2024-2718",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2024-2718"
          }
        },
        {
          "id": "BIT-cosign-2024-29902",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2024-29902"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-88jx-383q-w4qc"
          },
          "severity": "medium"
        }
      ],
      "description": "Cosign malicious attachments can cause system-wide denial of service.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.4, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nIndependently of version, the registry attachment path is not exercised: sbomify only runs `cosign verify-blob-attestation` against a local bundle file.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2024-29903",
      "id": "CVE-2024-29903",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-29903"
      },
      "references": [
        {
          "id": "GHSA-95pr-fxf5-86gv",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-95pr-fxf5-86gv"
          }
        },
        {
          "id": "GO-2024-2719",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2024-2719"
          }
        },
        {
          "id": "BIT-cosign-2024-29903",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2024-29903"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-95pr-fxf5-86gv"
          },
          "severity": "medium"
        }
      ],
      "description": "Cosign malicious artifacts can cause machine-wide denial of service.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory has no github.com/sigstore/cosign/v3 entry at all. It was fixed in the v2 module line at 2.2.4, well before the v3 module branched, so the vulnerable code has never been present in any v3 release.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nThe cosign subprocess is additionally bounded by an explicit timeout in sbomify/apps/plugins/builtins/verification.py.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-22703",
      "id": "CVE-2026-22703",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-22703"
      },
      "references": [
        {
          "id": "GHSA-whqx-f9j3-ch6m",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-whqx-f9j3-ch6m"
          }
        },
        {
          "id": "GO-2026-4309",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2026-4309"
          }
        },
        {
          "id": "BIT-cosign-2026-22703",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2026-22703"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-whqx-f9j3-ch6m"
          },
          "severity": "medium"
        }
      ],
      "description": "Cosign verification accepts any valid Rekor entry under certain conditions.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is fixed at 3.0.4. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-24122",
      "id": "CVE-2026-24122",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24122"
      },
      "references": [
        {
          "id": "GHSA-wfqv-66vq-46rm",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm"
          }
        },
        {
          "id": "GO-2026-4529",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2026-4529"
          }
        },
        {
          "id": "BIT-cosign-2026-24122",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2026-24122"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-wfqv-66vq-46rm"
          },
          "severity": "medium"
        }
      ],
      "description": "Cosign considered signatures valid with expired intermediate certificates when transparency log verification is skipped.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is fixed at 3.0.5. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nA second, independent reason this does not apply: the precondition is never met. sbomify's cosign invocation passes no flag that skips transparency log verification, and no COSIGN_* environment variable is set anywhere in the image or the application.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-39395",
      "id": "CVE-2026-39395",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39395"
      },
      "references": [
        {
          "id": "GHSA-w6c6-c85g-mmv6",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6"
          }
        },
        {
          "id": "GO-2026-5694",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/GO-2026-5694"
          }
        },
        {
          "id": "BIT-cosign-2026-39395",
          "source": {
            "name": "OSV",
            "url": "https://osv.dev/vulnerability/BIT-cosign-2026-39395"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/advisories/GHSA-w6c6-c85g-mmv6"
          },
          "severity": "medium"
        }
      ],
      "description": "Cosign's verify-blob-attestation reports a false positive when payload parsing fails.",
      "affects": [
        {
          "ref": "sbomify-container@v26.8.0",
          "versions": [
            {
              "version": "v26.8.0",
              "status": "unaffected"
            }
          ]
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign@v3.1.3"
        },
        {
          "ref": "pkg:golang/github.com/sigstore/cosign/v3@v3.1.3"
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_present",
        "response": [
          "will_not_fix"
        ],
        "detail": "The image ships cosign v3.1.3, which does not contain this vulnerability. The finding is an artifact of a malformed package URL in this tag's SBOM, not of the binary in the image.\n\nVerified in ghcr.io/sbomify/sbomify:v26.8.0 (index digest sha256:953fdc9693b5c504bd0db3734066c1feb7f8d4c9bc2cafe15dc4f3725160b014, linux/amd64 manifest sha256:84c652b88f5cb45aed29ab84a33b4262a5d4909b8e1bc4510d64fa4c4f8f980f): running `cosign version` inside the image reports GitVersion v3.1.3, GitCommit 11926fa5bbbbde47e88fc006b625a17769b743b2, built 2026-08-05, go1.26.4.\n\nRoot cause of the false match. This tag's SBOM identifies the binary as pkg:golang/github.com/sigstore/cosign@v3.1.3. A Go module path carries its major version as a suffix from v2 onward, so cosign v3.1.3 is the module github.com/sigstore/cosign/v3, confirmed by reading go.mod at tag v3.1.3. The path without the suffix names the abandoned v1 module. Advisory records carry a separate entry for that path with \"introduced 0\" and no fixed version, so it matches every version of cosign that has ever existed. That stale v1 entry, not the shipped binary, is what the scanner matched.\n\nStatus against the correct module path github.com/sigstore/cosign/v3: the advisory's v3 entry is introduced at 3.0.0 and fixed at 3.0.6. The shipped 3.1.3 is later than the fix, so the vulnerable code is not present in this image.\n\nFixed for future releases by sbomify PR #1519, which derives the major version suffix from the pinned version so the emitted PURL names the correct module. This statement covers tag v26.8.0, whose SBOM was published before that change and cannot be regenerated retroactively.\n\nThis is the one advisory whose subcommand sbomify actually runs: sbomify/apps/plugins/builtins/verification.py invokes `cosign verify-blob-attestation` on uploaded SBOMs and treats exit code 0 as verified. The shipped 3.1.3 is past the 3.0.6 fix, so the false positive behaviour is not present. Recorded here because a regression in this specific area would matter: the result feeds the verification:attestation category that compliance profiles consume.",
        "firstIssued": "2026-09-07T16:05:00Z",
        "lastUpdated": "2026-09-07T16:05:00Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-76172",
      "id": "CVE-2026-76172",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-76172"
      },
      "references": [
        {
          "id": "GHSA-jqff-g426-hqxp",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-jqff-g426-hqxp"
          },
          "severity": "high",
          "score": 7.5
        }
      ],
      "description": "fast-uri decodes percent-encoded characters in the scheme component with the legacy global unescape() and serializes the result back.",
      "affects": [
        {
          "ref": "sbomify@26.8.0",
          "versions": [
            {
              "version": "26.8.0",
              "status": "unaffected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "fast-uri 3.1.5 is present in the npm dependency graph but is not reachable from any attacker-influenced input in the deployed product.\n\n1. Single entry point, build time only. fast-uri enters the graph exclusively as a transitive dependency of ajv 8.20.0. The only two consumers of ajv are workbox-build 7.4.1 and @apideck/better-ajv-errors 0.3.7, both build-time Node tooling under vite-plugin-pwa 1.3.0 (configured at vite.config.ts:37). No first-party source imports ajv or fast-uri.\n\n2. Not shipped. workbox-build generates the service worker from the workbox-* runtime packages, none of which depend on ajv. fast-uri is absent from every browser bundle and from the Python server runtime, so the vulnerable code is never executed by the running application.\n\n3. Inputs are developer-controlled. ajv invokes fast-uri resolve() and normalize() when resolving JSON Schema $id and $ref values. The only schemas processed are workbox's own bundled configuration schemas, validated against the static PWA options hardcoded in vite.config.ts. No HTTP request data, uploaded SBOM, uploaded document or other user-supplied string reaches fast-uri.\n\nAll four advisories describe host or scheme confusion that requires a live URI validation or fetch decision. sbomify performs artifact validation server side in Python; fast-uri has no runtime presence there. Exploitation would require write access to the build configuration, which is already a higher privilege than the vulnerability grants.\n\nRemediation is planned regardless: the pin \"fast-uri\": \"3.1.5\" in the package.json overrides block (added in commit 8bf52363 to clear an earlier advisory) is what holds the graph at the vulnerable version. Raising it to 3.1.6 clears all four.",
        "firstIssued": "2026-09-07T15:28:42Z",
        "lastUpdated": "2026-09-07T15:28:42Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-75975",
      "id": "CVE-2026-75975",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75975"
      },
      "references": [
        {
          "id": "GHSA-f65p-4m7j-42xc",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-f65p-4m7j-42xc"
          },
          "severity": "high",
          "score": 7.5
        }
      ],
      "description": "fast-uri does not validate the complete RFC 3986 grammar for bracketed IPv6 literals.",
      "affects": [
        {
          "ref": "sbomify@26.8.0",
          "versions": [
            {
              "version": "26.8.0",
              "status": "unaffected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Same reachability analysis as CVE-2026-76172. fast-uri 3.1.5 is a build-time-only transitive dependency of ajv 8.20.0, reached only via workbox-build 7.4.1 and @apideck/better-ajv-errors 0.3.7 under vite-plugin-pwa 1.3.0. It is not bundled into any shipped browser asset and is absent from the Python server runtime. The only values passed to fast-uri are JSON Schema $id and $ref strings from workbox's own bundled schemas, validated against static PWA options hardcoded in vite.config.ts. No user-supplied host or IPv6 literal reaches the parser. Fixed upstream in 3.1.6; the update is blocked only by the package.json overrides pin and is planned.",
        "firstIssued": "2026-09-07T15:28:42Z",
        "lastUpdated": "2026-09-07T15:28:42Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-75899",
      "id": "CVE-2026-75899",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75899"
      },
      "references": [
        {
          "id": "GHSA-fph4-wmhf-6fwf",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-fph4-wmhf-6fwf"
          },
          "severity": "high",
          "score": 7.5
        }
      ],
      "description": "fast-uri decodes a hostname's percent escapes twice in a single normalize() or resolve() call.",
      "affects": [
        {
          "ref": "sbomify@26.8.0",
          "versions": [
            {
              "version": "26.8.0",
              "status": "unaffected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Same reachability analysis as CVE-2026-76172. The affected normalize() and resolve() entry points are invoked only by ajv 8.20.0 during JSON Schema $id and $ref resolution, at build time, on workbox's own bundled schemas and the static PWA options in vite.config.ts. fast-uri 3.1.5 reaches the graph solely through workbox-build 7.4.1 and @apideck/better-ajv-errors 0.3.7 under vite-plugin-pwa 1.3.0, is not bundled into any shipped browser asset, and is absent from the Python server runtime. No request-supplied hostname reaches these functions. Fixed upstream in 3.1.6; the update is blocked only by the package.json overrides pin and is planned.",
        "firstIssued": "2026-09-07T15:28:42Z",
        "lastUpdated": "2026-09-07T15:28:42Z"
      }
    },
    {
      "bom-ref": "vuln-cve-2026-75931",
      "id": "CVE-2026-75931",
      "source": {
        "name": "NVD",
        "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75931"
      },
      "references": [
        {
          "id": "GHSA-5jgf-p345-68v8",
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
          }
        }
      ],
      "ratings": [
        {
          "source": {
            "name": "GitHub Advisory Database",
            "url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-5jgf-p345-68v8"
          },
          "severity": "high",
          "score": 7.5
        }
      ],
      "description": "fast-uri canonicalizes a host to its ASCII form only when the input carries an explicit scheme.",
      "affects": [
        {
          "ref": "sbomify@26.8.0",
          "versions": [
            {
              "version": "26.8.0",
              "status": "unaffected"
            }
          ]
        }
      ],
      "analysis": {
        "state": "not_affected",
        "justification": "code_not_reachable",
        "response": [
          "update"
        ],
        "detail": "Same reachability analysis as CVE-2026-76172. The affected resolve() path is invoked only by ajv 8.20.0 during JSON Schema $id and $ref resolution, at build time, on workbox's own bundled schemas and the static PWA options in vite.config.ts. fast-uri 3.1.5 reaches the graph solely through workbox-build 7.4.1 and @apideck/better-ajv-errors 0.3.7 under vite-plugin-pwa 1.3.0, is not bundled into any shipped browser asset, and is absent from the Python server runtime. No user-supplied scheme-relative reference reaches the parser. Fixed upstream in 3.1.6; the update is blocked only by the package.json overrides pin and is planned.",
        "firstIssued": "2026-09-07T15:28:42Z",
        "lastUpdated": "2026-09-07T15:28:42Z"
      }
    }
  ]
}