Security triage review: 2026-10-12 (part 9/11) #478

Automated Flatcar security-triage review batch 38213056873, part 9 of 11.

Run metadata

• Analyzed (advisory) repository: flatcar/security-triage
• Review repository: flatcar/security-triage
• Workflow run: https://github.com/flatcar/security-triage/actions/runs/38213056873
• Commit: 497a3b79ec135bce0ecbf9ae4d2e6c58aa9d5090
• Generated at: 2026-10-12T07:03:57.248044+00:00
• Discovery report artifact: https://github.com/flatcar/security-triage/actions/runs/38213056873

Summary

This part contains 37 decision group(s).

Whole batch: 320 decision group(s) across 11 part(s).

How to use this review

• Check exactly one box per group to approve that action; leave a group fully unchecked to take no action for it.
• Checking more than one box in the same group cancels that group: it is skipped and reported as a conflict.
• Close this issue with reason Completed to apply every checked, conflict-free action.
• Close this issue as Not planned (or leave it open) to take no automated action at all.
• Do not edit the hidden HTML comments below the decision groups; they carry the machine-readable manifest this automation depends on.

Decision groups

Group 237: golang.org/x/net (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/08/10
• CVEs / upstream IDs: CVE-2026-78659, CVE-2026-78669, CVE-2026-78663, CVE-2026-97032, GO ISSUE 81857, GO ISSUE 81742, GO ISSUE 81743, GO ISSUE 81867
• CVSS: n/a
• Flatcar relevance: relevant (scope: production)
• Recommendation: create_issue (confidence: medium)
• SBOM matches: golang.org/x/net v0.33.0 (exact_name); golang.org/x/net v0.43.0 (exact_name); golang.org/x/net v0.51.0 (exact_name); golang.org/x/net v0.55.0 (exact_name); golang.org/x/net v0.55.0 (exact_name); golang.org/x/net v0.55.0 (exact_name); golang.org/x/net v0.55.0 (exact_name); golang.org/x/net v0.56.0 (exact_name); golang.org/x/net v0.56.0 (exact_name); golang.org/x/net v0.57.0 (exact_name); golang.org/x/net v0.58.0 (exact_name); golang.org/x/net v0.58.0 (exact_name); golang.org/x/net v0.58.0 (exact_name)
• Existing issue matches: none

The production SBOM contains exact golang.org/x/net module matches at versions v0.33.0 through v0.58.0, while upstream states that v0.60.0 fixes four HTTP/2 CVEs. No existing matching issue was found.

Name: golang.org/x/net
CVEs: CVE-2026-78659, CVE-2026-78669, CVE-2026-78663, CVE-2026-97032, GO ISSUE 81857, GO ISSUE 81742, GO ISSUE 81743, GO ISSUE 81867
CVSSs: n/a
Action Needed: update target
Summary: golang.org/x/net v0.60.0 fixes four HTTP/2 issues: server memory exhaustion from Trailer headers, excessive CPU use from repeated initial window changes, double flow-control refunds, and an HPACK encoder race that could crash servers.

refmap.gentoo: TBD

Choose at most one (leave all unchecked to take no action for this group):

• Create new advisory issue: update: golang.org/x/net

Group 238: mistral (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/1
• CVEs / upstream IDs: CVE-2026-93858, CVE-2026-93860, CVE-2026-93861, CVE-2026-97147
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

OpenStack Mistral is not present in the production SBOM, no existing Flatcar issue matches these CVEs, and the bundle provides no evidence that Flatcar ships or uses it.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 239: ironic (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/2
• CVEs / upstream IDs: CVE-2026-90461
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Ironic is not present in the provided production SBOM evidence, and no evidence shows that Flatcar ships or uses this OpenStack application.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 240: linux (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/3
• CVEs / upstream IDs: CVE-2026-98375, XSA-522
• CVSS: n/a
• Flatcar relevance: kernel_regular_update_flow (scope: production)
• Recommendation: kernel_regular_update_flow (confidence: high)
• SBOM matches: github.com/opencontainers/selinux v1.13.0 (ambiguous_substring); github.com/opencontainers/selinux v1.13.1 (ambiguous_substring); github.com/opencontainers/selinux v1.15.1 (ambiguous_substring); linux-kernel 6.12.111-flatcar (ambiguous_substring); sec-policy/selinux-base 2.20260312_p1 (ambiguous_substring); sec-policy/selinux-base-policy 2.20260312_p1-r1 (ambiguous_substring); sec-policy/selinux-container 2.20260312_p1 (ambiguous_substring); sec-policy/selinux-dbus 2.20260312_p1 (ambiguous_substring); sec-policy/selinux-policykit 2.20260312_p1 (ambiguous_substring); sec-policy/selinux-sssd 2.20260312_p1 (ambiguous_substring); sec-policy/selinux-unconfined 2.20260312_p1 (ambiguous_substring); sys-apps/util-linux 2.42.3 (ambiguous_substring); sys-kernel/linux-headers 6.18 (ambiguous_substring); sys-libs/libselinux 3.11-r1 (ambiguous_substring)
• Existing issue matches: none

CVE-2026-98375 affects the Linux xen-netfront kernel driver, and Flatcar's production SBOM contains linux-kernel 6.12.111-flatcar. Kernel CVEs must be routed through the kernel regular update flow.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: routed to the regular kernel update flow (no advisory issue)

Group 241: Apache CXF (org.apache.cxf:cxf-rt-rs-security-sso-oidc) (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/4
• CVEs / upstream IDs: CVE-2026-71575
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: github.com/aws/aws-sdk-go-v2/service/sso v1.31.3 (ambiguous_substring); github.com/aws/aws-sdk-go-v2/service/sso v1.33.8 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 242: Apache CXF (cxf-rt-rs-security-oauth2) (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/5
• CVEs / upstream IDs: CVE-2026-73179
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: cloud.google.com/go/auth v0.20.0 (ambiguous_substring); golang.org/x/oauth2 v0.35.0 (ambiguous_substring); golang.org/x/oauth2 v0.36.0 (ambiguous_substring); golang.org/x/oauth2 v0.36.0 (ambiguous_substring); golang.org/x/oauth2 v0.36.0 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 243: Apache CXF (org.apache.cxf:cxf-core) (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/6
• CVEs / upstream IDs: CVE-2026-78384
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: acct-group/core 0 (ambiguous_substring); acct-user/core 0 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 244: apache-cxf (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/7
• CVEs / upstream IDs: CVE-2026-79650
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF OIDC RP is not evidenced as shipped or used by Flatcar, and there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 245: Apache CXF cxf-rt-rs-extension-search (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/8
• CVEs / upstream IDs: CVE-2026-86463
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF cxf-rt-rs-extension-search has no production SBOM matches or other evidence that Flatcar ships or uses it; no existing issue is present.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 246: Apache CXF (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/9
• CVEs / upstream IDs: CVE-2026-97468
• CVSS: n/a
• Flatcar relevance: needs_manual_review (scope: unknown)
• Recommendation: needs_manual_review (confidence: low)
• SBOM matches: none
• Existing issue matches: none

LLM relevance decision requested manual review.

• Safety/ambiguity notes: LLM relevance decision requested manual review.

Name: Apache CXF
CVEs: CVE-2026-97468
CVSSs: n/a
Action Needed: update target
Summary: Apache CXF STS token validation accepted attacker-crafted tokens sharing a weak 32-bit cache hash with a validated token, enabling authentication bypass and potentially fraudulent STS-signed tokens.

refmap.gentoo: TBD

Choose at most one (leave all unchecked to take no action for this group):

• Create new advisory issue: update: Apache CXF
• No advisory action (ignore/defer)
• Manual handling outside the pipeline

Group 247: apache-cxf (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/10
• CVEs / upstream IDs: CVE-2026-97791
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF is not evidenced as shipped or used by Flatcar, and there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 248: apache-cxf (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/11
• CVEs / upstream IDs: CVE-2026-100227
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF has no production SBOM match or other evidence of being shipped or used by Flatcar; it is an unrelated Java application framework vulnerability.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 249: apache-cxf (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/12
• CVEs / upstream IDs: CVE-2026-107937
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF has no production SBOM match or other evidence that Flatcar ships or uses it.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 250: Apache CXF (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/13
• CVEs / upstream IDs: CVE-2026-107938
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF is an application-level Java web-services framework, and the evidence contains no indication that Flatcar ships or uses it; no production SBOM matches exist.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 251: apache-cxf (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/14
• CVEs / upstream IDs: CVE-2026-108039
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache CXF is not evidenced as shipped or used by Flatcar, and there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 252: Apache Camel Karavan (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/16
• CVEs / upstream IDs: CVE-2026-103412
• CVSS: 8.8
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache Camel Karavan is an application-level Java project-management component, and the bundle provides no evidence that Flatcar ships or uses it; no production SBOM matches or existing issues are present.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 253: Apache Camel Karavan (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/17
• CVEs / upstream IDs: CVE-2026-103413
• CVSS: 8.8
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache Camel Karavan is an application-level Kubernetes deployment tool, and the bundle provides no evidence that Flatcar ships or uses it.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 254: illumos door server processes (nscd, ipmgmtd, nwamd, reparsed, zonestatd) (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/18
• CVEs / upstream IDs: CVE-2026-104112, CVE-2026-104113, CVE-2026-104114, CVE-2026-104115, CVE-2026-104116, CVE-2026-104117
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: ../server (devel) (ambiguous_substring); ../server (devel) (ambiguous_substring); sys-apps/sed 4.10-r1 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 255: bhyve (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/19
• CVEs / upstream IDs: CVE-2026-102916
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: none
• Existing issue matches: none

The CVE affects illumos bhyve VMM emulation, and there is no evidence that Flatcar ships or uses bhyve; no production SBOM match exists.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 256: cyrus-sasl (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/20
• CVEs / upstream IDs: CVE-2026-107161, CYRUS SASL ISSUE #887, CYRUS SASL ISSUE #888, CYRUS SASL ISSUE #889, CYRUS SASL ISSUE #895, CYRUS SASL ISSUE #896, VS-CSASL-2026-0001
• CVSS: n/a
• Flatcar relevance: needs_manual_review (scope: production)
• Recommendation: needs_manual_review (confidence: low)
• SBOM matches: dev-libs/cyrus-sasl 2.1.28-r5 (exact_name)
• Existing issue matches: none

LLM relevance decision requested manual review.

• Safety/ambiguity notes: LLM relevance decision requested manual review.

Name: cyrus-sasl
CVEs: CVE-2026-107161, CYRUS SASL ISSUE #887, CYRUS SASL ISSUE #888, CYRUS SASL ISSUE #889, CYRUS SASL ISSUE #895, CYRUS SASL ISSUE #896, VS-CSASL-2026-0001
CVSSs: n/a
Action Needed: TBD
Summary: Upstream reports several unresolved Cyrus SASL issues: memory leaks, a SCRAM GS2 header heap out-of-bounds read, a DIGEST-MD5 heap buffer overflow, a static-build/PIC defect, and an SRP authentication bypass. CVE-2026-107161 is reported for the DIGEST-MD5 issue, although the exact mapping is uncertain; no affected or fixed versions are provided.

refmap.gentoo: TBD

Choose at most one (leave all unchecked to take no action for this group):

• Create new advisory issue: update: cyrus-sasl
• No advisory action (ignore/defer)
• Manual handling outside the pipeline

Group 257: mutt (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/09/21
• CVEs / upstream IDs: CVE-2026-107570
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Mutt is an email client and there is no evidence that it is shipped or used by Flatcar; no production SBOM match exists.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 258: aspell (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/1
• CVEs / upstream IDs: CVE-2026-75818, CVE-2026-75819, CVE-2026-75820
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

GNU Aspell is not evidenced as shipped or used by Flatcar, and there are no production SBOM matches.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 259: datasketches-cpp (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/2
• CVEs / upstream IDs: CVE-2026-103501
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

datasketches-cpp has no production SBOM match or other evidence of shipment or use by Flatcar.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 260: datasketches-cpp (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/3
• CVEs / upstream IDs: CVE-2026-103513
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

No existing issue or production SBOM match indicates that Flatcar ships or uses Apache DataSketches C++ (datasketches-cpp).

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 261: datasketches-cpp (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/4
• CVEs / upstream IDs: CVE-2026-103634
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache DataSketches C++ (datasketches-cpp) has no production SBOM match or other evidence that Flatcar ships or uses it.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 262: datasketches-cpp (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/5
• CVEs / upstream IDs: CVE-2026-103635
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache DataSketches C++ is not evidenced as shipped or used by Flatcar; there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 263: datasketches-cpp (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/6
• CVEs / upstream IDs: CVE-2026-103636
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

Apache DataSketches C++ is not evidenced as shipped or used by Flatcar; no production SBOM package match or existing issue is present.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 264: ExtUtils-Typemaps-Default (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/7
• CVEs / upstream IDs: CVE-2026-107373, CVE-2026-80490, CPAN RT #94110
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 (ambiguous_substring); k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 (ambiguous_substring); k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 265: ExtUtils-Typemaps-Default (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/10/8
• CVEs / upstream IDs: CVE-2026-107794, CVE-2013-10076
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 (ambiguous_substring); k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 (ambiguous_substring); k8s.io/utils v0.0.0-20260319190234-28399d86e0b5 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 266: emacs (discovery, source: oss_security)

• Source URL: https://www.openwall.com/lists/oss-security/2026/10/11/1
• CVEs / upstream IDs: CVE-2026-79992
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

The issue affects Emacs TRAMP, a desktop/editor application component, and there is no evidence that Emacs is shipped or used by Flatcar.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 267: github.com/shamaton/msgpack (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-4513
• CVEs / upstream IDs: CVE-2026-32284, GHSA-h9q6-hc68-35rp, GO-2026-4513
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: github.com/hashicorp/go-msgpack/v2 v2.1.5 (ambiguous_substring); github.com/tinylib/msgp v1.3.0 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 268: github.com/shamaton/msgpack (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-4740
• CVEs / upstream IDs: GO-2026-4740, CVE-2026-32284, GHSA-h9q6-hc68-35rp, x/vulndb: potential Go vuln in github.com/shamaton/msgpack golang/vulndb#4513
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: medium)
• SBOM matches: github.com/hashicorp/go-msgpack/v2 v2.1.5 (ambiguous_substring); github.com/tinylib/msgp v1.3.0 (ambiguous_substring)
• Existing issue matches: none

LLM judged the only SBOM matches unrelated; treat this as strong not-shipped evidence.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 269: google.golang.org/grpc (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-6443
• CVEs / upstream IDs: CVE-2026-84445, GHSA-2v4p-qf9q-27wj, GO-2026-6443
• CVSS: n/a
• Flatcar relevance: relevant (scope: production)
• Recommendation: update_existing_issue (confidence: high)
• SBOM matches: google.golang.org/grpc v1.80.0 (exact_name); google.golang.org/grpc v1.80.0 (exact_name); google.golang.org/grpc v1.80.0 (exact_name); google.golang.org/grpc v1.80.0 (exact_name); google.golang.org/grpc v1.81.1 (exact_name); google.golang.org/grpc v1.82.1 (exact_name); google.golang.org/grpc v1.82.1 (exact_name); google.golang.org/grpc v1.83.2 (exact_name); google.golang.org/grpc v1.83.2 (exact_name)
• Existing issue matches: update: google.golang.org/grpc #159 (open): update: google.golang.org/grpc

Open issue #159 already matches google.golang.org/grpc and CVE-2026-84445. Production SBOM entries include affected versions, and the new GO-2026-6443/GHSA alias, corrected fixed version, affected ranges, and xDS-routing panic details should be reflected in that issue.

Gentoo Bugzilla has new or changed upstream context for this advisory.

Recommended review items:
- Add CVEs: GHSA-2V4P-QF9Q-27WJ, GO-2026-6443
- Add upstream context: gRPC servers using xDS routing can panic and terminate when processing requests missing both :authority and Host headers.
- Review upstream references: GHSA-2v4p-qf9q-27wj, https://github.com/grpc/grpc-go/security/advisories/GHSA-2v4p-qf9q-27wj, https://github.com/grpc/grpc-go/issues/9354, https://github.com/grpc/grpc-go/pull/9365
- Review Bugzilla description: In google.golang.org/grpc, servers configured with xDS routing can panic when processing requests that lack both :authority and Host headers. The HTTP/2 transport layer accepted requests missing these headers, and the xDS server routing interceptor attempted to index the empty authority slice, ca...

Source: https://pkg.go.dev/vuln/GO-2026-6443

This is a guarded automation recommendation; maintainers should review before editing the advisory body.

Choose at most one (leave all unchecked to take no action for this group):

• Update existing issue update: google.golang.org/grpc #159 with new upstream context

Group 270: github.com/pocketbase/pocketbase (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-6489
• CVEs / upstream IDs: CVE-2026-82410, GHSA-84vh-m24q-wjjx, GO-2026-6489
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

PocketBase is an application-level Go package with no evidence that Flatcar ships or uses it; there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 271: github.com/hatchet-dev/hatchet (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-6535
• CVEs / upstream IDs: CVE-2026-61687, GHSA-phg3-3g28-wq9v, GO-2026-6535
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

The affected Go application module is not evidenced as shipped or used by Flatcar, and there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 272: github.com/hatchet-dev/hatchet (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-6565
• CVEs / upstream IDs: CVE-2026-61681, GHSA-fjwv-jf2v-j499
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

No evidence shows Flatcar ships or uses github.com/hatchet-dev/hatchet, and there are no production SBOM matches or existing issues.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

Group 273: github.com/cilium/cilium (discovery, source: go_vulndb)

• Source URL: https://pkg.go.dev/vuln/GO-2026-6596
• CVEs / upstream IDs: CVE-2026-56742, GHSA-w7c2-w76w-5hmj, GO-2026-6596
• CVSS: n/a
• Flatcar relevance: not_relevant (scope: not_shipped)
• Recommendation: ignore (confidence: high)
• SBOM matches: none
• Existing issue matches: none

No production SBOM matches or other evidence shows that Flatcar ships or uses github.com/cilium/cilium; no existing issue is present.

Choose at most one (leave all unchecked to take no action for this group):

• Acknowledge: no advisory action needed

_{This section is machine-readable metadata used by the apply automation. It is safe to ignore while reviewing.}