{"schema_version":"2","view":"grouped","data":[{"id":71351,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/advisories/advisory%3A7cd21f13-c782-40ff-a0c6-c84540dcd72a","group":{"id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","revision":1,"primary_event_id":71742,"change":"published","superseded_by":[],"changed":{"id":71742,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/71742"},"members":[{"id":71742,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-cp9c-mgch-xrq4","summary":"CGA-cp9c-mgch-xrq4","evidence":"osv:CGA-cp9c-mgch-xrq4","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-cp9c-mgch-xrq4","aliases":["CGA-cp9c-mgch-xrq4"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-cp9c-mgch-xrq4.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:40:06Z"}]}}],"modified":"2026-10-02T23:00:43.577457181Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7cd21f13-c782-40ff-a0c6-c84540dcd72a","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-cp9c-mgch-xrq4","advisory_id":"7cd21f13-c782-40ff-a0c6-c84540dcd72a","event_types":["advisory"],"published_at":"2026-10-25T23:04:16.183435+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:40+00:00","detail_url":"/events/71742"}]}},{"id":71064,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/advisories/advisory%3A1138c2e6-508d-4299-8d9f-1b74249e6394","group":{"id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","revision":1,"primary_event_id":71438,"change":"published","superseded_by":[],"changed":{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"},"members":[{"id":71438,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-w6q5-c9m4-6q56","summary":"CGA-w6q5-c9m4-6q56","evidence":"osv:CGA-w6q5-c9m4-6q56","products":[{"name":{"value":"kserve-pmmlserver-fips","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w6q5-c9m4-6q56","aliases":["CGA-w6q5-c9m4-6q56"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r1"}]}],"package":{"name":"kserve-pmmlserver-fips","purl":"pkg:apk/chainguard/kserve-pmmlserver-fips?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w6q5-c9m4-6q56.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/chainguard/kserve-pmmlserver/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T16:00:41Z"}]}}],"modified":"2026-10-02T23:00:11.658924629Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1138c2e6-508d-4299-8d9f-1b74249e6394","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w6q5-c9m4-6q56","advisory_id":"1138c2e6-508d-4299-8d9f-1b74249e6394","event_types":["advisory"],"published_at":"2026-10-25T22:49:03.318767+00:00","technologies":["core-osv","kserve-pmmlserver-fips"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:48:09+00:00","detail_url":"/events/71438"}]}},{"id":70834,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/advisories/advisory%3A6e1950f4-494a-4c66-9279-4a02bcdbf27c","group":{"id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","revision":1,"primary_event_id":71205,"change":"published","superseded_by":[],"changed":{"id":71205,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/events/71205"},"members":[{"id":71205,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-xq89-f5vc-8774","summary":"CGA-xq89-f5vc-8774","evidence":"osv:CGA-xq89-f5vc-8774","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xq89-f5vc-8774","aliases":["CGA-xq89-f5vc-8774"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xq89-f5vc-8774.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:08:02Z"}]}}],"modified":"2026-10-02T18:25:48.972722394Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6e1950f4-494a-4c66-9279-4a02bcdbf27c","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xq89-f5vc-8774","advisory_id":"6e1950f4-494a-4c66-9279-4a02bcdbf27c","event_types":["advisory"],"published_at":"2026-10-25T22:41:31.677873+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:24:50+00:00","detail_url":"/events/71205"}]}},{"id":70754,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-q9c2-fx4p-35q3","summary":"CGA-q9c2-fx4p-35q3","evidence":"osv:CGA-q9c2-fx4p-35q3","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-q9c2-fx4p-35q3","aliases":["CGA-q9c2-fx4p-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q9c2-fx4p-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:49Z"}]}}],"modified":"2026-10-02T18:25:44.323990548Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:43abc443-4b44-4347-9086-2d30942490d8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q9c2-fx4p-35q3","advisory_id":"43abc443-4b44-4347-9086-2d30942490d8","event_types":["advisory"],"published_at":"2026-10-25T22:37:50.800344+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:21:38+00:00","detail_url":"/advisories/advisory%3A43abc443-4b44-4347-9086-2d30942490d8","group":{"id":"advisory:43abc443-4b44-4347-9086-2d30942490d8","revision":1,"primary_event_id":71125,"change":"published","superseded_by":[],"changed":{"id":71125,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-q9c2-fx4p-35q3","summary":"CGA-q9c2-fx4p-35q3","evidence":"osv:CGA-q9c2-fx4p-35q3","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-q9c2-fx4p-35q3","aliases":["CGA-q9c2-fx4p-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q9c2-fx4p-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:49Z"}]}}],"modified":"2026-10-02T18:25:44.323990548Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:43abc443-4b44-4347-9086-2d30942490d8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q9c2-fx4p-35q3","advisory_id":"43abc443-4b44-4347-9086-2d30942490d8","event_types":["advisory"],"published_at":"2026-10-25T22:37:50.800344+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:21:38+00:00","detail_url":"/events/71125"},"members":[{"id":71125,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-q9c2-fx4p-35q3","summary":"CGA-q9c2-fx4p-35q3","evidence":"osv:CGA-q9c2-fx4p-35q3","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-q9c2-fx4p-35q3","aliases":["CGA-q9c2-fx4p-35q3"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-q9c2-fx4p-35q3.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T08:53:49Z"}]}}],"modified":"2026-10-02T18:25:44.323990548Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:43abc443-4b44-4347-9086-2d30942490d8","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-q9c2-fx4p-35q3","advisory_id":"43abc443-4b44-4347-9086-2d30942490d8","event_types":["advisory"],"published_at":"2026-10-25T22:37:50.800344+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:21:38+00:00","detail_url":"/events/71125"}]}},{"id":70665,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j45g-cjh9-g69c","summary":"CGA-j45g-cjh9-g69c","evidence":"osv:CGA-j45g-cjh9-g69c","products":[{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j45g-cjh9-g69c","aliases":["CGA-j45g-cjh9-g69c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}}],"modified":"2026-10-02T18:25:40.370480511Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:71cb3a41-d3b0-4465-8980-67ee2006d4db","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j45g-cjh9-g69c","advisory_id":"71cb3a41-d3b0-4465-8980-67ee2006d4db","event_types":["advisory"],"published_at":"2026-10-25T22:33:59.356166+00:00","technologies":["core-osv","datadog-agent-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:34+00:00","detail_url":"/advisories/advisory%3A71cb3a41-d3b0-4465-8980-67ee2006d4db","group":{"id":"advisory:71cb3a41-d3b0-4465-8980-67ee2006d4db","revision":1,"primary_event_id":71036,"change":"published","superseded_by":[],"changed":{"id":71036,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j45g-cjh9-g69c","summary":"CGA-j45g-cjh9-g69c","evidence":"osv:CGA-j45g-cjh9-g69c","products":[{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j45g-cjh9-g69c","aliases":["CGA-j45g-cjh9-g69c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}}],"modified":"2026-10-02T18:25:40.370480511Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:71cb3a41-d3b0-4465-8980-67ee2006d4db","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j45g-cjh9-g69c","advisory_id":"71cb3a41-d3b0-4465-8980-67ee2006d4db","event_types":["advisory"],"published_at":"2026-10-25T22:33:59.356166+00:00","technologies":["core-osv","datadog-agent-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:34+00:00","detail_url":"/events/71036"},"members":[{"id":71036,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j45g-cjh9-g69c","summary":"CGA-j45g-cjh9-g69c","evidence":"osv:CGA-j45g-cjh9-g69c","products":[{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j45g-cjh9-g69c","aliases":["CGA-j45g-cjh9-g69c"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.79-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j45g-cjh9-g69c.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:49:22Z"}]}}],"modified":"2026-10-02T18:25:40.370480511Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:71cb3a41-d3b0-4465-8980-67ee2006d4db","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j45g-cjh9-g69c","advisory_id":"71cb3a41-d3b0-4465-8980-67ee2006d4db","event_types":["advisory"],"published_at":"2026-10-25T22:33:59.356166+00:00","technologies":["core-osv","datadog-agent-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:34+00:00","detail_url":"/events/71036"}]}},{"id":70647,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-hm9p-9j97-h232","summary":"CGA-hm9p-9j97-h232","evidence":"osv:CGA-hm9p-9j97-h232","products":[{"name":{"value":"authentik-fips-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hm9p-9j97-h232","aliases":["CGA-hm9p-9j97-h232"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-fips-2025.12","purl":"pkg:apk/chainguard/authentik-fips-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm9p-9j97-h232.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:46Z"}]}}],"modified":"2026-10-02T18:25:39.704449024Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f0cdf3b-81ab-488a-8999-e7e003be48cc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm9p-9j97-h232","advisory_id":"6f0cdf3b-81ab-488a-8999-e7e003be48cc","event_types":["advisory"],"published_at":"2026-10-25T22:33:17.694834+00:00","technologies":["authentik-fips-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:15:59+00:00","detail_url":"/advisories/advisory%3A6f0cdf3b-81ab-488a-8999-e7e003be48cc","group":{"id":"advisory:6f0cdf3b-81ab-488a-8999-e7e003be48cc","revision":1,"primary_event_id":71017,"change":"published","superseded_by":[],"changed":{"id":71017,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-hm9p-9j97-h232","summary":"CGA-hm9p-9j97-h232","evidence":"osv:CGA-hm9p-9j97-h232","products":[{"name":{"value":"authentik-fips-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hm9p-9j97-h232","aliases":["CGA-hm9p-9j97-h232"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-fips-2025.12","purl":"pkg:apk/chainguard/authentik-fips-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm9p-9j97-h232.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:46Z"}]}}],"modified":"2026-10-02T18:25:39.704449024Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f0cdf3b-81ab-488a-8999-e7e003be48cc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm9p-9j97-h232","advisory_id":"6f0cdf3b-81ab-488a-8999-e7e003be48cc","event_types":["advisory"],"published_at":"2026-10-25T22:33:17.694834+00:00","technologies":["authentik-fips-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:15:59+00:00","detail_url":"/events/71017"},"members":[{"id":71017,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-hm9p-9j97-h232","summary":"CGA-hm9p-9j97-h232","evidence":"osv:CGA-hm9p-9j97-h232","products":[{"name":{"value":"authentik-fips-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-hm9p-9j97-h232","aliases":["CGA-hm9p-9j97-h232"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-fips-2025.12","purl":"pkg:apk/chainguard/authentik-fips-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-hm9p-9j97-h232.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:46Z"}]}}],"modified":"2026-10-02T18:25:39.704449024Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6f0cdf3b-81ab-488a-8999-e7e003be48cc","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-hm9p-9j97-h232","advisory_id":"6f0cdf3b-81ab-488a-8999-e7e003be48cc","event_types":["advisory"],"published_at":"2026-10-25T22:33:17.694834+00:00","technologies":["authentik-fips-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:15:59+00:00","detail_url":"/events/71017"}]}},{"id":70403,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-mj72-92g7-7552","summary":"CGA-mj72-92g7-7552","evidence":"osv:CGA-mj72-92g7-7552","products":[{"name":{"value":"datadog-agent-fips-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mj72-92g7-7552","aliases":["CGA-mj72-92g7-7552"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mj72-92g7-7552.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:55:10Z"}]}}],"modified":"2026-10-02T18:25:26.950112624Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84e9a2d0-41eb-493e-b79b-d7b8a2c68774","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mj72-92g7-7552","advisory_id":"84e9a2d0-41eb-493e-b79b-d7b8a2c68774","event_types":["advisory"],"published_at":"2026-10-25T22:23:29.757971+00:00","technologies":["core-osv","datadog-agent-fips-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:25:53+00:00","detail_url":"/advisories/advisory%3A84e9a2d0-41eb-493e-b79b-d7b8a2c68774","group":{"id":"advisory:84e9a2d0-41eb-493e-b79b-d7b8a2c68774","revision":1,"primary_event_id":70773,"change":"published","superseded_by":[],"changed":{"id":70773,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-mj72-92g7-7552","summary":"CGA-mj72-92g7-7552","evidence":"osv:CGA-mj72-92g7-7552","products":[{"name":{"value":"datadog-agent-fips-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mj72-92g7-7552","aliases":["CGA-mj72-92g7-7552"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mj72-92g7-7552.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:55:10Z"}]}}],"modified":"2026-10-02T18:25:26.950112624Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84e9a2d0-41eb-493e-b79b-d7b8a2c68774","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mj72-92g7-7552","advisory_id":"84e9a2d0-41eb-493e-b79b-d7b8a2c68774","event_types":["advisory"],"published_at":"2026-10-25T22:23:29.757971+00:00","technologies":["core-osv","datadog-agent-fips-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:25:53+00:00","detail_url":"/events/70773"},"members":[{"id":70773,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-mj72-92g7-7552","summary":"CGA-mj72-92g7-7552","evidence":"osv:CGA-mj72-92g7-7552","products":[{"name":{"value":"datadog-agent-fips-7.79-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-mj72-92g7-7552","aliases":["CGA-mj72-92g7-7552"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.79-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.79-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-mj72-92g7-7552.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:55:10Z"}]}}],"modified":"2026-10-02T18:25:26.950112624Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:84e9a2d0-41eb-493e-b79b-d7b8a2c68774","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-mj72-92g7-7552","advisory_id":"84e9a2d0-41eb-493e-b79b-d7b8a2c68774","event_types":["advisory"],"published_at":"2026-10-25T22:23:29.757971+00:00","technologies":["core-osv","datadog-agent-fips-7-79-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:25:53+00:00","detail_url":"/events/70773"}]}},{"id":70332,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-m3r2-r7h6-37qv","summary":"CGA-m3r2-r7h6-37qv","evidence":"osv:CGA-m3r2-r7h6-37qv","products":[{"name":{"value":"datadog-agent-fips-7.83-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m3r2-r7h6-37qv","aliases":["CGA-m3r2-r7h6-37qv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.83-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.83-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3r2-r7h6-37qv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:39:25Z"}]}}],"modified":"2026-10-02T18:25:23.833929710Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6f9d38c-51c8-4858-940c-8fb3e17b34b1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3r2-r7h6-37qv","advisory_id":"d6f9d38c-51c8-4858-940c-8fb3e17b34b1","event_types":["advisory"],"published_at":"2026-10-25T22:21:19.6964+00:00","technologies":["core-osv","datadog-agent-fips-7-83-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:55:39+00:00","detail_url":"/advisories/advisory%3Ad6f9d38c-51c8-4858-940c-8fb3e17b34b1","group":{"id":"advisory:d6f9d38c-51c8-4858-940c-8fb3e17b34b1","revision":1,"primary_event_id":70702,"change":"published","superseded_by":[],"changed":{"id":70702,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-m3r2-r7h6-37qv","summary":"CGA-m3r2-r7h6-37qv","evidence":"osv:CGA-m3r2-r7h6-37qv","products":[{"name":{"value":"datadog-agent-fips-7.83-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m3r2-r7h6-37qv","aliases":["CGA-m3r2-r7h6-37qv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.83-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.83-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3r2-r7h6-37qv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:39:25Z"}]}}],"modified":"2026-10-02T18:25:23.833929710Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6f9d38c-51c8-4858-940c-8fb3e17b34b1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3r2-r7h6-37qv","advisory_id":"d6f9d38c-51c8-4858-940c-8fb3e17b34b1","event_types":["advisory"],"published_at":"2026-10-25T22:21:19.6964+00:00","technologies":["core-osv","datadog-agent-fips-7-83-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:55:39+00:00","detail_url":"/events/70702"},"members":[{"id":70702,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-m3r2-r7h6-37qv","summary":"CGA-m3r2-r7h6-37qv","evidence":"osv:CGA-m3r2-r7h6-37qv","products":[{"name":{"value":"datadog-agent-fips-7.83-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-m3r2-r7h6-37qv","aliases":["CGA-m3r2-r7h6-37qv"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.83-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-fips-7.83-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-m3r2-r7h6-37qv.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:39:25Z"}]}}],"modified":"2026-10-02T18:25:23.833929710Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6f9d38c-51c8-4858-940c-8fb3e17b34b1","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-m3r2-r7h6-37qv","advisory_id":"d6f9d38c-51c8-4858-940c-8fb3e17b34b1","event_types":["advisory"],"published_at":"2026-10-25T22:21:19.6964+00:00","technologies":["core-osv","datadog-agent-fips-7-83-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:55:39+00:00","detail_url":"/events/70702"}]}},{"id":70267,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-9wx7-239h-wcx7","summary":"CGA-9wx7-239h-wcx7","evidence":"osv:CGA-9wx7-239h-wcx7","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9wx7-239h-wcx7","aliases":["CGA-9wx7-239h-wcx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}}],"modified":"2026-10-02T18:25:20.753882790Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6557bc94-e02a-4cb5-8d51-63ccff13e84b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wx7-239h-wcx7","advisory_id":"6557bc94-e02a-4cb5-8d51-63ccff13e84b","event_types":["advisory"],"published_at":"2026-10-25T22:19:30.661403+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:39+00:00","detail_url":"/advisories/advisory%3A6557bc94-e02a-4cb5-8d51-63ccff13e84b","group":{"id":"advisory:6557bc94-e02a-4cb5-8d51-63ccff13e84b","revision":1,"primary_event_id":70637,"change":"published","superseded_by":[],"changed":{"id":70637,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-9wx7-239h-wcx7","summary":"CGA-9wx7-239h-wcx7","evidence":"osv:CGA-9wx7-239h-wcx7","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9wx7-239h-wcx7","aliases":["CGA-9wx7-239h-wcx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}}],"modified":"2026-10-02T18:25:20.753882790Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6557bc94-e02a-4cb5-8d51-63ccff13e84b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wx7-239h-wcx7","advisory_id":"6557bc94-e02a-4cb5-8d51-63ccff13e84b","event_types":["advisory"],"published_at":"2026-10-25T22:19:30.661403+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:39+00:00","detail_url":"/events/70637"},"members":[{"id":70637,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-9wx7-239h-wcx7","summary":"CGA-9wx7-239h-wcx7","evidence":"osv:CGA-9wx7-239h-wcx7","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9wx7-239h-wcx7","aliases":["CGA-9wx7-239h-wcx7"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9wx7-239h-wcx7.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:14:14Z"}]}}],"modified":"2026-10-02T18:25:20.753882790Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6557bc94-e02a-4cb5-8d51-63ccff13e84b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9wx7-239h-wcx7","advisory_id":"6557bc94-e02a-4cb5-8d51-63ccff13e84b","event_types":["advisory"],"published_at":"2026-10-25T22:19:30.661403+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:39+00:00","detail_url":"/events/70637"}]}},{"id":70264,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/advisories/advisory%3A2162a601-2441-4adc-8897-bec92a296a00","group":{"id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","revision":1,"primary_event_id":70634,"change":"published","superseded_by":[],"changed":{"id":70634,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70634"},"members":[{"id":70634,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-c2hm-rm7q-pj26","summary":"CGA-c2hm-rm7q-pj26","evidence":"osv:CGA-c2hm-rm7q-pj26","products":[{"name":{"value":"airflow-2","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-c2hm-rm7q-pj26","aliases":["CGA-c2hm-rm7q-pj26"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"airflow-2","purl":"pkg:apk/chainguard/airflow-2?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-c2hm-rm7q-pj26.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/airflow/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:19:30Z"}]}}],"modified":"2026-10-02T18:25:20.746674029Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2162a601-2441-4adc-8897-bec92a296a00","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-c2hm-rm7q-pj26","advisory_id":"2162a601-2441-4adc-8897-bec92a296a00","event_types":["advisory"],"published_at":"2026-10-25T22:19:26.008945+00:00","technologies":["airflow-2","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:45+00:00","detail_url":"/events/70634"}]}},{"id":69682,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-rpq9-vp45-r5fx","summary":"CGA-rpq9-vp45-r5fx","evidence":"osv:CGA-rpq9-vp45-r5fx","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rpq9-vp45-r5fx","aliases":["CGA-rpq9-vp45-r5fx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}}],"modified":"2026-10-02T17:16:47.885179782Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40dc35aa-e8fe-4353-821b-1bd72a1eedd4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rpq9-vp45-r5fx","advisory_id":"40dc35aa-e8fe-4353-821b-1bd72a1eedd4","event_types":["advisory"],"published_at":"2026-10-25T22:05:18.067587+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:28:16+00:00","detail_url":"/advisories/advisory%3A40dc35aa-e8fe-4353-821b-1bd72a1eedd4","group":{"id":"advisory:40dc35aa-e8fe-4353-821b-1bd72a1eedd4","revision":1,"primary_event_id":70052,"change":"published","superseded_by":[],"changed":{"id":70052,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-rpq9-vp45-r5fx","summary":"CGA-rpq9-vp45-r5fx","evidence":"osv:CGA-rpq9-vp45-r5fx","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rpq9-vp45-r5fx","aliases":["CGA-rpq9-vp45-r5fx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}}],"modified":"2026-10-02T17:16:47.885179782Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40dc35aa-e8fe-4353-821b-1bd72a1eedd4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rpq9-vp45-r5fx","advisory_id":"40dc35aa-e8fe-4353-821b-1bd72a1eedd4","event_types":["advisory"],"published_at":"2026-10-25T22:05:18.067587+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:28:16+00:00","detail_url":"/events/70052"},"members":[{"id":70052,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-rpq9-vp45-r5fx","summary":"CGA-rpq9-vp45-r5fx","evidence":"osv:CGA-rpq9-vp45-r5fx","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rpq9-vp45-r5fx","aliases":["CGA-rpq9-vp45-r5fx"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rpq9-vp45-r5fx.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T13:25:00Z"}]}}],"modified":"2026-10-02T17:16:47.885179782Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:40dc35aa-e8fe-4353-821b-1bd72a1eedd4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rpq9-vp45-r5fx","advisory_id":"40dc35aa-e8fe-4353-821b-1bd72a1eedd4","event_types":["advisory"],"published_at":"2026-10-25T22:05:18.067587+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:28:16+00:00","detail_url":"/events/70052"}]}},{"id":69360,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j7x4-p7qw-h764","summary":"CGA-j7x4-p7qw-h764","evidence":"osv:CGA-j7x4-p7qw-h764","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7x4-p7qw-h764","aliases":["CGA-j7x4-p7qw-h764"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7x4-p7qw-h764.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:43:07Z"}]}}],"modified":"2026-10-02T17:16:33.082037399Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7x4-p7qw-h764","advisory_id":"a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","event_types":["advisory"],"published_at":"2026-10-25T21:57:13.908251+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:03:35+00:00","detail_url":"/advisories/advisory%3Aa39c5afa-b8e4-4474-abf0-2820ed8b4f2e","group":{"id":"advisory:a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","revision":1,"primary_event_id":69730,"change":"published","superseded_by":[],"changed":{"id":69730,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j7x4-p7qw-h764","summary":"CGA-j7x4-p7qw-h764","evidence":"osv:CGA-j7x4-p7qw-h764","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7x4-p7qw-h764","aliases":["CGA-j7x4-p7qw-h764"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7x4-p7qw-h764.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:43:07Z"}]}}],"modified":"2026-10-02T17:16:33.082037399Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7x4-p7qw-h764","advisory_id":"a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","event_types":["advisory"],"published_at":"2026-10-25T21:57:13.908251+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:03:35+00:00","detail_url":"/events/69730"},"members":[{"id":69730,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-j7x4-p7qw-h764","summary":"CGA-j7x4-p7qw-h764","evidence":"osv:CGA-j7x4-p7qw-h764","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-j7x4-p7qw-h764","aliases":["CGA-j7x4-p7qw-h764"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-j7x4-p7qw-h764.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:43:07Z"}]}}],"modified":"2026-10-02T17:16:33.082037399Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-j7x4-p7qw-h764","advisory_id":"a39c5afa-b8e4-4474-abf0-2820ed8b4f2e","event_types":["advisory"],"published_at":"2026-10-25T21:57:13.908251+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:03:35+00:00","detail_url":"/events/69730"}]}},{"id":68921,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-5h6f-mpc8-45fp","summary":"CGA-5h6f-mpc8-45fp","evidence":"osv:CGA-5h6f-mpc8-45fp","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5h6f-mpc8-45fp","aliases":["CGA-5h6f-mpc8-45fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h6f-mpc8-45fp.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T11:15:07Z"}]}}],"modified":"2026-10-02T17:15:59.685197991Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7dc9250c-1dc4-4545-bbb8-c77862c2f51f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h6f-mpc8-45fp","advisory_id":"7dc9250c-1dc4-4545-bbb8-c77862c2f51f","event_types":["advisory"],"published_at":"2026-10-25T21:49:09.047749+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:29+00:00","detail_url":"/advisories/advisory%3A7dc9250c-1dc4-4545-bbb8-c77862c2f51f","group":{"id":"advisory:7dc9250c-1dc4-4545-bbb8-c77862c2f51f","revision":1,"primary_event_id":69291,"change":"published","superseded_by":[],"changed":{"id":69291,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-5h6f-mpc8-45fp","summary":"CGA-5h6f-mpc8-45fp","evidence":"osv:CGA-5h6f-mpc8-45fp","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5h6f-mpc8-45fp","aliases":["CGA-5h6f-mpc8-45fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h6f-mpc8-45fp.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T11:15:07Z"}]}}],"modified":"2026-10-02T17:15:59.685197991Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7dc9250c-1dc4-4545-bbb8-c77862c2f51f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h6f-mpc8-45fp","advisory_id":"7dc9250c-1dc4-4545-bbb8-c77862c2f51f","event_types":["advisory"],"published_at":"2026-10-25T21:49:09.047749+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:29+00:00","detail_url":"/events/69291"},"members":[{"id":69291,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-5h6f-mpc8-45fp","summary":"CGA-5h6f-mpc8-45fp","evidence":"osv:CGA-5h6f-mpc8-45fp","products":[{"name":{"value":"mlrun","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5h6f-mpc8-45fp","aliases":["CGA-5h6f-mpc8-45fp"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun","purl":"pkg:apk/chainguard/mlrun?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5h6f-mpc8-45fp.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T11:15:07Z"}]}}],"modified":"2026-10-02T17:15:59.685197991Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7dc9250c-1dc4-4545-bbb8-c77862c2f51f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5h6f-mpc8-45fp","advisory_id":"7dc9250c-1dc4-4545-bbb8-c77862c2f51f","event_types":["advisory"],"published_at":"2026-10-25T21:49:09.047749+00:00","technologies":["core-osv","mlrun"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:33:29+00:00","detail_url":"/events/69291"}]}},{"id":68733,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-6xgj-8fm9-g4x9","summary":"CGA-6xgj-8fm9-g4x9","evidence":"osv:CGA-6xgj-8fm9-g4x9","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-6xgj-8fm9-g4x9","aliases":["CGA-6xgj-8fm9-g4x9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}}],"modified":"2026-10-02T17:15:11.831864774Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f80bac06-0056-4c8c-b6bc-5950af8a0bb4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6xgj-8fm9-g4x9","advisory_id":"f80bac06-0056-4c8c-b6bc-5950af8a0bb4","event_types":["advisory"],"published_at":"2026-10-25T21:45:15.973743+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:36:01+00:00","detail_url":"/advisories/advisory%3Af80bac06-0056-4c8c-b6bc-5950af8a0bb4","group":{"id":"advisory:f80bac06-0056-4c8c-b6bc-5950af8a0bb4","revision":1,"primary_event_id":69103,"change":"published","superseded_by":[],"changed":{"id":69103,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-6xgj-8fm9-g4x9","summary":"CGA-6xgj-8fm9-g4x9","evidence":"osv:CGA-6xgj-8fm9-g4x9","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-6xgj-8fm9-g4x9","aliases":["CGA-6xgj-8fm9-g4x9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}}],"modified":"2026-10-02T17:15:11.831864774Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f80bac06-0056-4c8c-b6bc-5950af8a0bb4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6xgj-8fm9-g4x9","advisory_id":"f80bac06-0056-4c8c-b6bc-5950af8a0bb4","event_types":["advisory"],"published_at":"2026-10-25T21:45:15.973743+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:36:01+00:00","detail_url":"/events/69103"},"members":[{"id":69103,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-6xgj-8fm9-g4x9","summary":"CGA-6xgj-8fm9-g4x9","evidence":"osv:CGA-6xgj-8fm9-g4x9","products":[{"name":{"value":"kserve-storage-controller","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"kserve-storage-controller","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0-r2","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-6xgj-8fm9-g4x9","aliases":["CGA-6xgj-8fm9-g4x9"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/chainguard/kserve-storage-controller?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.21.0-r2"}]}],"package":{"name":"kserve-storage-controller","purl":"pkg:apk/wolfi/kserve-storage-controller?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-6xgj-8fm9-g4x9.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.2.2","component_type":"python","component_version":"3.2.2","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.2.2.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T14:09:35Z"}]}}],"modified":"2026-10-02T17:15:11.831864774Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f80bac06-0056-4c8c-b6bc-5950af8a0bb4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-6xgj-8fm9-g4x9","advisory_id":"f80bac06-0056-4c8c-b6bc-5950af8a0bb4","event_types":["advisory"],"published_at":"2026-10-25T21:45:15.973743+00:00","technologies":["core-osv","kserve-storage-controller"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:36:01+00:00","detail_url":"/events/69103"}]}},{"id":67597,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-f9p5-57f3-rp78","summary":"CGA-f9p5-57f3-rp78","evidence":"osv:CGA-f9p5-57f3-rp78","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9p5-57f3-rp78","aliases":["CGA-f9p5-57f3-rp78"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9p5-57f3-rp78.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:07:00Z"}]}}],"modified":"2026-10-02T11:00:10.961428084Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1249e53-8d46-44e1-a971-09415d43ea0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9p5-57f3-rp78","advisory_id":"b1249e53-8d46-44e1-a971-09415d43ea0f","event_types":["advisory"],"published_at":"2026-10-25T21:19:26.93552+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:16:36+00:00","detail_url":"/advisories/advisory%3Ab1249e53-8d46-44e1-a971-09415d43ea0f","group":{"id":"advisory:b1249e53-8d46-44e1-a971-09415d43ea0f","revision":1,"primary_event_id":67967,"change":"published","superseded_by":[],"changed":{"id":67967,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-f9p5-57f3-rp78","summary":"CGA-f9p5-57f3-rp78","evidence":"osv:CGA-f9p5-57f3-rp78","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9p5-57f3-rp78","aliases":["CGA-f9p5-57f3-rp78"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9p5-57f3-rp78.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:07:00Z"}]}}],"modified":"2026-10-02T11:00:10.961428084Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1249e53-8d46-44e1-a971-09415d43ea0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9p5-57f3-rp78","advisory_id":"b1249e53-8d46-44e1-a971-09415d43ea0f","event_types":["advisory"],"published_at":"2026-10-25T21:19:26.93552+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:16:36+00:00","detail_url":"/events/67967"},"members":[{"id":67967,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-f9p5-57f3-rp78","summary":"CGA-f9p5-57f3-rp78","evidence":"osv:CGA-f9p5-57f3-rp78","products":[{"name":{"value":"mlrun-api","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.12.0-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-f9p5-57f3-rp78","aliases":["CGA-f9p5-57f3-rp78"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.0-r1"}]}],"package":{"name":"mlrun-api","purl":"pkg:apk/chainguard/mlrun-api?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-f9p5-57f3-rp78.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.11/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T09:07:00Z"}]}}],"modified":"2026-10-02T11:00:10.961428084Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b1249e53-8d46-44e1-a971-09415d43ea0f","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-f9p5-57f3-rp78","advisory_id":"b1249e53-8d46-44e1-a971-09415d43ea0f","event_types":["advisory"],"published_at":"2026-10-25T21:19:26.93552+00:00","technologies":["core-osv","mlrun-api"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:16:36+00:00","detail_url":"/events/67967"}]}},{"id":67591,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-8hw2-66r4-9rjg","summary":"CGA-8hw2-66r4-9rjg","evidence":"osv:CGA-8hw2-66r4-9rjg","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-8hw2-66r4-9rjg","aliases":["CGA-8hw2-66r4-9rjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}}],"modified":"2026-10-02T11:00:09.739170447Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:997ca399-8621-439d-b1a9-61f377bb0fa4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8hw2-66r4-9rjg","advisory_id":"997ca399-8621-439d-b1a9-61f377bb0fa4","event_types":["advisory"],"published_at":"2026-10-25T21:19:21.369926+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:49:12+00:00","detail_url":"/advisories/advisory%3A997ca399-8621-439d-b1a9-61f377bb0fa4","group":{"id":"advisory:997ca399-8621-439d-b1a9-61f377bb0fa4","revision":1,"primary_event_id":67961,"change":"published","superseded_by":[],"changed":{"id":67961,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-8hw2-66r4-9rjg","summary":"CGA-8hw2-66r4-9rjg","evidence":"osv:CGA-8hw2-66r4-9rjg","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-8hw2-66r4-9rjg","aliases":["CGA-8hw2-66r4-9rjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}}],"modified":"2026-10-02T11:00:09.739170447Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:997ca399-8621-439d-b1a9-61f377bb0fa4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8hw2-66r4-9rjg","advisory_id":"997ca399-8621-439d-b1a9-61f377bb0fa4","event_types":["advisory"],"published_at":"2026-10-25T21:19:21.369926+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:49:12+00:00","detail_url":"/events/67961"},"members":[{"id":67961,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-8hw2-66r4-9rjg","summary":"CGA-8hw2-66r4-9rjg","evidence":"osv:CGA-8hw2-66r4-9rjg","products":[{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-core-integrations","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-8hw2-66r4-9rjg","aliases":["CGA-8hw2-66r4-9rjg"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/chainguard/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-core-integrations","purl":"pkg:apk/wolfi/datadog-agent-7.77-core-integrations?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-8hw2-66r4-9rjg.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/opt/datadog-agent/embedded/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:09:14Z"}]}}],"modified":"2026-10-02T11:00:09.739170447Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:997ca399-8621-439d-b1a9-61f377bb0fa4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-8hw2-66r4-9rjg","advisory_id":"997ca399-8621-439d-b1a9-61f377bb0fa4","event_types":["advisory"],"published_at":"2026-10-25T21:19:21.369926+00:00","technologies":["core-osv","datadog-agent-7-77-core-integrations"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:49:12+00:00","detail_url":"/events/67961"}]}},{"id":67572,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-4jp8-876m-cg58","summary":"CGA-4jp8-876m-cg58","evidence":"osv:CGA-4jp8-876m-cg58","products":[{"name":{"value":"jupyter-base-notebook","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jupyter-base-notebook","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jp8-876m-cg58","aliases":["CGA-4jp8-876m-cg58"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/chainguard/jupyter-base-notebook?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/wolfi/jupyter-base-notebook?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}}],"modified":"2026-10-02T11:00:07.442227279Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ba1b9966-e4b1-4cab-a497-20f7a323ecc0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jp8-876m-cg58","advisory_id":"ba1b9966-e4b1-4cab-a497-20f7a323ecc0","event_types":["advisory"],"published_at":"2026-10-25T21:19:05.428822+00:00","technologies":["core-osv","jupyter-base-notebook"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:51+00:00","detail_url":"/advisories/advisory%3Aba1b9966-e4b1-4cab-a497-20f7a323ecc0","group":{"id":"advisory:ba1b9966-e4b1-4cab-a497-20f7a323ecc0","revision":1,"primary_event_id":67942,"change":"published","superseded_by":[],"changed":{"id":67942,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-4jp8-876m-cg58","summary":"CGA-4jp8-876m-cg58","evidence":"osv:CGA-4jp8-876m-cg58","products":[{"name":{"value":"jupyter-base-notebook","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jupyter-base-notebook","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jp8-876m-cg58","aliases":["CGA-4jp8-876m-cg58"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/chainguard/jupyter-base-notebook?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/wolfi/jupyter-base-notebook?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}}],"modified":"2026-10-02T11:00:07.442227279Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ba1b9966-e4b1-4cab-a497-20f7a323ecc0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jp8-876m-cg58","advisory_id":"ba1b9966-e4b1-4cab-a497-20f7a323ecc0","event_types":["advisory"],"published_at":"2026-10-25T21:19:05.428822+00:00","technologies":["core-osv","jupyter-base-notebook"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:51+00:00","detail_url":"/events/67942"},"members":[{"id":67942,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-4jp8-876m-cg58","summary":"CGA-4jp8-876m-cg58","evidence":"osv:CGA-4jp8-876m-cg58","products":[{"name":{"value":"jupyter-base-notebook","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"jupyter-base-notebook","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.6.3-r1","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jp8-876m-cg58","aliases":["CGA-4jp8-876m-cg58"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/chainguard/jupyter-base-notebook?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.6.3-r1"}]}],"package":{"name":"jupyter-base-notebook","purl":"pkg:apk/wolfi/jupyter-base-notebook?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jp8-876m-cg58.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T03:55:08Z"}]}}],"modified":"2026-10-02T11:00:07.442227279Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ba1b9966-e4b1-4cab-a497-20f7a323ecc0","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jp8-876m-cg58","advisory_id":"ba1b9966-e4b1-4cab-a497-20f7a323ecc0","event_types":["advisory"],"published_at":"2026-10-25T21:19:05.428822+00:00","technologies":["core-osv","jupyter-base-notebook"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:14:51+00:00","detail_url":"/events/67942"}]}},{"id":66903,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-wc9m-c6v5-qqf8","summary":"CGA-wc9m-c6v5-qqf8","evidence":"osv:CGA-wc9m-c6v5-qqf8","products":[{"name":{"value":"ggshield","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"ggshield","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc9m-c6v5-qqf8","aliases":["CGA-wc9m-c6v5-qqf8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/chainguard/ggshield?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/wolfi/ggshield?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}}],"modified":"2026-10-02T05:17:43.359372642Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7628efe0-c73c-469b-ad9f-b9d5a56643f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc9m-c6v5-qqf8","advisory_id":"7628efe0-c73c-469b-ad9f-b9d5a56643f4","event_types":["advisory"],"published_at":"2026-10-25T21:06:57.079444+00:00","technologies":["core-osv","ggshield"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:50:00+00:00","detail_url":"/advisories/advisory%3A7628efe0-c73c-469b-ad9f-b9d5a56643f4","group":{"id":"advisory:7628efe0-c73c-469b-ad9f-b9d5a56643f4","revision":1,"primary_event_id":67273,"change":"published","superseded_by":[],"changed":{"id":67273,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-wc9m-c6v5-qqf8","summary":"CGA-wc9m-c6v5-qqf8","evidence":"osv:CGA-wc9m-c6v5-qqf8","products":[{"name":{"value":"ggshield","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"ggshield","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc9m-c6v5-qqf8","aliases":["CGA-wc9m-c6v5-qqf8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/chainguard/ggshield?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/wolfi/ggshield?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}}],"modified":"2026-10-02T05:17:43.359372642Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7628efe0-c73c-469b-ad9f-b9d5a56643f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc9m-c6v5-qqf8","advisory_id":"7628efe0-c73c-469b-ad9f-b9d5a56643f4","event_types":["advisory"],"published_at":"2026-10-25T21:06:57.079444+00:00","technologies":["core-osv","ggshield"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:50:00+00:00","detail_url":"/events/67273"},"members":[{"id":67273,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-wc9m-c6v5-qqf8","summary":"CGA-wc9m-c6v5-qqf8","evidence":"osv:CGA-wc9m-c6v5-qqf8","products":[{"name":{"value":"ggshield","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"ggshield","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"1.55.0-r3","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wc9m-c6v5-qqf8","aliases":["CGA-wc9m-c6v5-qqf8"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/chainguard/ggshield?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.55.0-r3"}]}],"package":{"name":"ggshield","purl":"pkg:apk/wolfi/ggshield?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wc9m-c6v5-qqf8.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/ggshield/lib/python3.12/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T01:05:32Z"}]}}],"modified":"2026-10-02T05:17:43.359372642Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:7628efe0-c73c-469b-ad9f-b9d5a56643f4","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wc9m-c6v5-qqf8","advisory_id":"7628efe0-c73c-469b-ad9f-b9d5a56643f4","event_types":["advisory"],"published_at":"2026-10-25T21:06:57.079444+00:00","technologies":["core-osv","ggshield"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:50:00+00:00","detail_url":"/events/67273"}]}},{"id":66597,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-pr2w-m843-gc7r","summary":"CGA-pr2w-m843-gc7r","evidence":"osv:CGA-pr2w-m843-gc7r","products":[{"name":{"value":"authentik-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pr2w-m843-gc7r","aliases":["CGA-pr2w-m843-gc7r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-2025.12","purl":"pkg:apk/chainguard/authentik-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr2w-m843-gc7r.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T00:21:39Z"}]}}],"modified":"2026-10-02T05:17:36.641953049Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr2w-m843-gc7r","advisory_id":"2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","event_types":["advisory"],"published_at":"2026-10-25T21:02:26.621013+00:00","technologies":["authentik-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:38:02+00:00","detail_url":"/advisories/advisory%3A2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","group":{"id":"advisory:2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","revision":1,"primary_event_id":66967,"change":"published","superseded_by":[],"changed":{"id":66967,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-pr2w-m843-gc7r","summary":"CGA-pr2w-m843-gc7r","evidence":"osv:CGA-pr2w-m843-gc7r","products":[{"name":{"value":"authentik-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pr2w-m843-gc7r","aliases":["CGA-pr2w-m843-gc7r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-2025.12","purl":"pkg:apk/chainguard/authentik-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr2w-m843-gc7r.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T00:21:39Z"}]}}],"modified":"2026-10-02T05:17:36.641953049Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr2w-m843-gc7r","advisory_id":"2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","event_types":["advisory"],"published_at":"2026-10-25T21:02:26.621013+00:00","technologies":["authentik-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:38:02+00:00","detail_url":"/events/66967"},"members":[{"id":66967,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"CGA-pr2w-m843-gc7r","summary":"CGA-pr2w-m843-gc7r","evidence":"osv:CGA-pr2w-m843-gc7r","products":[{"name":{"value":"authentik-2025.12","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-pr2w-m843-gc7r","aliases":["CGA-pr2w-m843-gc7r"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"authentik-2025.12","purl":"pkg:apk/chainguard/authentik-2025.12?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-pr2w-m843-gc7r.json"},"ecosystem_specific":{"components":[{"component_name":"oauthlib","component_purl":"pkg:pypi/oauthlib@3.3.1","component_type":"python","component_version":"3.3.1","component_location":"/usr/share/authentik-2025.12/venv/lib/python3.13/site-packages/oauthlib-3.3.1.dist-info/METADATA","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T00:21:39Z"}]}}],"modified":"2026-10-02T05:17:36.641953049Z","provider":"osv","upstream":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv"],"references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-pr2w-m843-gc7r","advisory_id":"2f04262e-8b1c-491e-bf5d-4c793f7ca4fa","event_types":["advisory"],"published_at":"2026-10-25T21:02:26.621013+00:00","technologies":["authentik-2025-12","core-osv"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:38:02+00:00","detail_url":"/events/66967"}]}},{"id":63257,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","summary":"## Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks. ## Affected Component - File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py` - Functions: `code_challenge_method_plain`, `code_challenge_method_s256` - Vulnerability Type: CWE-208 (Observable Timing Discrepancy) ## Technical Details Python's `==` operator uses short-circuit evaluation when comparing strings: 1. Returns `False` immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle. ## Proof of Concept Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time): | Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s | | 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s | | **Difference** | | **0.03741s** | The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions. ## Attack Scenario 1. Attacker intercepts `authorization_code","evidence":"osv:PYSEC-2026-4114","products":[{"name":{"value":"oauthlib","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/0/versions"},{"value":"3.0.1","evidence":"/affected/0/versions"},{"value":"3.0.2","evidence":"/affected/0/versions"},{"value":"3.1.0","evidence":"/affected/0/versions"},{"value":"3.1.1","evidence":"/affected/0/versions"},{"value":"3.2.0","evidence":"/affected/0/versions"},{"value":"3.2.1","evidence":"/affected/0/versions"},{"value":"3.2.2","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"}]}],"severity":"unknown","structured":{"id":"PYSEC-2026-4114","aliases":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv","PYSEC-2026-4114"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.0"}]}],"package":{"name":"oauthlib","purl":"pkg:pypi/oauthlib","ecosystem":"PyPI"},"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/oauthlib/PYSEC-2026-4114.yaml"}}],"modified":"2026-10-01T17:45:10.985894602Z","provider":"osv","references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib","https://pypi.org/project/oauthlib","https://github.com/advisories/GHSA-xpv3-w29h-x7cv","https://nvd.nist.gov/vuln/detail/CVE-2026-49265"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e16f546-5d21-442e-bc1e-540efaa068ba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PYSEC-2026-4114","advisory_id":"5e16f546-5d21-442e-bc1e-540efaa068ba","event_types":["advisory"],"published_at":"2026-10-25T19:26:20.633581+00:00","technologies":["core-osv","oauthlib"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T16:38:40.027+00:00","detail_url":"/advisories/advisory%3A5e16f546-5d21-442e-bc1e-540efaa068ba","group":{"id":"advisory:5e16f546-5d21-442e-bc1e-540efaa068ba","revision":1,"primary_event_id":62491,"change":"published","superseded_by":[],"changed":{"id":62491,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","summary":"## Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks. ## Affected Component - File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py` - Functions: `code_challenge_method_plain`, `code_challenge_method_s256` - Vulnerability Type: CWE-208 (Observable Timing Discrepancy) ## Technical Details Python's `==` operator uses short-circuit evaluation when comparing strings: 1. Returns `False` immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle. ## Proof of Concept Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time): | Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s | | 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s | | **Difference** | | **0.03741s** | The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions. ## Attack Scenario 1. Attacker intercepts `authorization_code","evidence":"osv:PYSEC-2026-4114","products":[{"name":{"value":"oauthlib","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/0/versions"},{"value":"3.0.1","evidence":"/affected/0/versions"},{"value":"3.0.2","evidence":"/affected/0/versions"},{"value":"3.1.0","evidence":"/affected/0/versions"},{"value":"3.1.1","evidence":"/affected/0/versions"},{"value":"3.2.0","evidence":"/affected/0/versions"},{"value":"3.2.1","evidence":"/affected/0/versions"},{"value":"3.2.2","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"}]}],"severity":"unknown","structured":{"id":"PYSEC-2026-4114","aliases":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv","PYSEC-2026-4114"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.0"}]}],"package":{"name":"oauthlib","purl":"pkg:pypi/oauthlib","ecosystem":"PyPI"},"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/oauthlib/PYSEC-2026-4114.yaml"}}],"modified":"2026-10-01T17:45:10.985894602Z","provider":"osv","references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib","https://pypi.org/project/oauthlib","https://github.com/advisories/GHSA-xpv3-w29h-x7cv","https://nvd.nist.gov/vuln/detail/CVE-2026-49265"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e16f546-5d21-442e-bc1e-540efaa068ba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PYSEC-2026-4114","advisory_id":"5e16f546-5d21-442e-bc1e-540efaa068ba","event_types":["advisory"],"published_at":"2026-10-25T19:26:20.633581+00:00","technologies":["core-osv","oauthlib"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T16:38:40.027+00:00","detail_url":"/events/62491"},"members":[{"id":62491,"cve_ids":["CVE-2026-49265"],"payload":{"kind":"advisory","title":"Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)","summary":"## Summary A timing side-channel vulnerability exists in the PKCE (RFC 7636) implementation of the Authorization Code Grant flow. The `code_challenge_method_plain` function uses Python's standard `==` operator for string comparison instead of a constant-time comparison function, potentially allowing timing-based attacks. ## Affected Component - File: `oauthlib/oauth2/rfc6749/grant_types/authorization_code.py` - Functions: `code_challenge_method_plain`, `code_challenge_method_s256` - Vulnerability Type: CWE-208 (Observable Timing Discrepancy) ## Technical Details Python's `==` operator uses short-circuit evaluation when comparing strings: 1. Returns `False` immediately if lengths differ 2. Compares characters left-to-right, stopping at first mismatch This means comparison time varies linearly with the length of the common prefix between the attacker-supplied verifier and the stored challenge, creating a measurable timing oracle. ## Proof of Concept Tested locally against oauthlib source (network jitter eliminated to isolate pure Python execution time): | Input | Result | Time (10M iterations) | |---|---|---| | Wrong first char (`B` + `A`*49) | Fast reject | 0.34106s | | 49 chars correct (`A`*49 + `B`) | Deep compare | 0.37847s | | **Difference** | | **0.03741s** | The ~37ms delta over 10M iterations corresponds to nanosecond-level differences per call, which are statistically exploitable under controlled conditions. ## Attack Scenario 1. Attacker intercepts `authorization_code","evidence":"osv:PYSEC-2026-4114","products":[{"name":{"value":"oauthlib","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"4.0.0","evidence":"/affected/0/ranges"}],"affected_versions":[{"value":"3.0.0","evidence":"/affected/0/versions"},{"value":"3.0.1","evidence":"/affected/0/versions"},{"value":"3.0.2","evidence":"/affected/0/versions"},{"value":"3.1.0","evidence":"/affected/0/versions"},{"value":"3.1.1","evidence":"/affected/0/versions"},{"value":"3.2.0","evidence":"/affected/0/versions"},{"value":"3.2.1","evidence":"/affected/0/versions"},{"value":"3.2.2","evidence":"/affected/0/versions"},{"value":"3.3.0","evidence":"/affected/0/versions"},{"value":"3.3.1","evidence":"/affected/0/versions"}]}],"severity":"unknown","structured":{"id":"PYSEC-2026-4114","aliases":["CVE-2026-49265","GHSA-xpv3-w29h-x7cv","PYSEC-2026-4114"],"metrics":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"4.0.0"}]}],"package":{"name":"oauthlib","purl":"pkg:pypi/oauthlib","ecosystem":"PyPI"},"versions":["3.0.0","3.0.1","3.0.2","3.1.0","3.1.1","3.2.0","3.2.1","3.2.2","3.3.0","3.3.1"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/oauthlib/PYSEC-2026-4114.yaml"}}],"modified":"2026-10-01T17:45:10.985894602Z","provider":"osv","references":["https://github.com/oauthlib/oauthlib/security/advisories/GHSA-xpv3-w29h-x7cv","https://github.com/oauthlib/oauthlib/pull/963","https://github.com/oauthlib/oauthlib/commit/40b0ab56da3682c2484a4b78bbff309f8025d950","https://github.com/oauthlib/oauthlib","https://pypi.org/project/oauthlib","https://github.com/advisories/GHSA-xpv3-w29h-x7cv","https://nvd.nist.gov/vuln/detail/CVE-2026-49265"]},"related_cves":[{"value":"CVE-2026-49265","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"advisory:5e16f546-5d21-442e-bc1e-540efaa068ba","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-49265","metrics":[{"cvssV3_1":{"scope":"UNCHANGED","version":"3.1","baseScore":6.8,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","integrityImpact":"HIGH","userInteraction":"REQUIRED","attackComplexity":"HIGH","availabilityImpact":"NONE","privilegesRequired":"NONE","confidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"oauthlib","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-49265","relationship":"advisory","known_exploited":false,"relationship_evidence":"/aliases"}],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/PYSEC-2026-4114","advisory_id":"5e16f546-5d21-442e-bc1e-540efaa068ba","event_types":["advisory"],"published_at":"2026-10-25T19:26:20.633581+00:00","technologies":["core-osv","oauthlib"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T16:38:40.027+00:00","detail_url":"/events/62491"}]}}],"next_after":71351,"next_before":63257}