{"schema_version":"2","view":"grouped","data":[{"id":70943,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4pxx-f3qv-3v85","summary":"CGA-4pxx-f3qv-3v85","evidence":"osv:CGA-4pxx-f3qv-3v85","products":[{"name":{"value":"elastic-otel-collector-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4pxx-f3qv-3v85","aliases":["CGA-4pxx-f3qv-3v85"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"elastic-otel-collector-fips-9.3","purl":"pkg:apk/chainguard/elastic-otel-collector-fips-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4pxx-f3qv-3v85.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/elastic-otel-collector","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:38:43Z"}]}}],"modified":"2026-10-02T18:28:02.035612952Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ff5ffcd2-c434-42c6-80b0-a98dce31c093","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4pxx-f3qv-3v85","advisory_id":"ff5ffcd2-c434-42c6-80b0-a98dce31c093","event_types":["advisory"],"published_at":"2026-10-25T22:45:12.076436+00:00","technologies":["core-osv","elastic-otel-collector-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:26:31+00:00","detail_url":"/advisories/advisory%3Aff5ffcd2-c434-42c6-80b0-a98dce31c093","group":{"id":"advisory:ff5ffcd2-c434-42c6-80b0-a98dce31c093","revision":1,"primary_event_id":71314,"change":"published","superseded_by":[],"changed":{"id":71314,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4pxx-f3qv-3v85","summary":"CGA-4pxx-f3qv-3v85","evidence":"osv:CGA-4pxx-f3qv-3v85","products":[{"name":{"value":"elastic-otel-collector-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4pxx-f3qv-3v85","aliases":["CGA-4pxx-f3qv-3v85"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"elastic-otel-collector-fips-9.3","purl":"pkg:apk/chainguard/elastic-otel-collector-fips-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4pxx-f3qv-3v85.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/elastic-otel-collector","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:38:43Z"}]}}],"modified":"2026-10-02T18:28:02.035612952Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ff5ffcd2-c434-42c6-80b0-a98dce31c093","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4pxx-f3qv-3v85","advisory_id":"ff5ffcd2-c434-42c6-80b0-a98dce31c093","event_types":["advisory"],"published_at":"2026-10-25T22:45:12.076436+00:00","technologies":["core-osv","elastic-otel-collector-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:26:31+00:00","detail_url":"/events/71314"},"members":[{"id":71314,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4pxx-f3qv-3v85","summary":"CGA-4pxx-f3qv-3v85","evidence":"osv:CGA-4pxx-f3qv-3v85","products":[{"name":{"value":"elastic-otel-collector-fips-9.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4pxx-f3qv-3v85","aliases":["CGA-4pxx-f3qv-3v85"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"elastic-otel-collector-fips-9.3","purl":"pkg:apk/chainguard/elastic-otel-collector-fips-9.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4pxx-f3qv-3v85.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/elastic-otel-collector","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:38:43Z"}]}}],"modified":"2026-10-02T18:28:02.035612952Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ff5ffcd2-c434-42c6-80b0-a98dce31c093","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4pxx-f3qv-3v85","advisory_id":"ff5ffcd2-c434-42c6-80b0-a98dce31c093","event_types":["advisory"],"published_at":"2026-10-25T22:45:12.076436+00:00","technologies":["core-osv","elastic-otel-collector-fips-9-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:26:31+00:00","detail_url":"/events/71314"}]}},{"id":70940,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/advisories/advisory%3A45f9121d-759d-4996-8ca9-7f3de8553eb6","group":{"id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","revision":1,"primary_event_id":71311,"change":"published","superseded_by":[],"changed":{"id":71311,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/events/71311"},"members":[{"id":71311,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vhj2-7jfv-qpx9","summary":"CGA-vhj2-7jfv-qpx9","evidence":"osv:CGA-vhj2-7jfv-qpx9","products":[{"name":{"value":"grafana-11.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vhj2-7jfv-qpx9","aliases":["CGA-vhj2-7jfv-qpx9"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"grafana-11.6","purl":"pkg:apk/chainguard/grafana-11.6?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vhj2-7jfv-qpx9.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:29:41Z"}]}}],"modified":"2026-10-02T18:28:00.910365423Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:45f9121d-759d-4996-8ca9-7f3de8553eb6","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vhj2-7jfv-qpx9","advisory_id":"45f9121d-759d-4996-8ca9-7f3de8553eb6","event_types":["advisory"],"published_at":"2026-10-25T22:45:09.206453+00:00","technologies":["core-osv","grafana-11-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T10:07:18+00:00","detail_url":"/events/71311"}]}},{"id":70932,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4jcq-82w3-m7g2","summary":"CGA-4jcq-82w3-m7g2","evidence":"osv:CGA-4jcq-82w3-m7g2","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jcq-82w3-m7g2","aliases":["CGA-4jcq-82w3-m7g2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jcq-82w3-m7g2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:28Z"}]}}],"modified":"2026-10-02T18:28:00.022235324Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f38333a9-d5c6-4684-92fb-65d6d441dca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jcq-82w3-m7g2","advisory_id":"f38333a9-d5c6-4684-92fb-65d6d441dca1","event_types":["advisory"],"published_at":"2026-10-25T22:45:00.269666+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:53:33+00:00","detail_url":"/advisories/advisory%3Af38333a9-d5c6-4684-92fb-65d6d441dca1","group":{"id":"advisory:f38333a9-d5c6-4684-92fb-65d6d441dca1","revision":1,"primary_event_id":71303,"change":"published","superseded_by":[],"changed":{"id":71303,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4jcq-82w3-m7g2","summary":"CGA-4jcq-82w3-m7g2","evidence":"osv:CGA-4jcq-82w3-m7g2","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jcq-82w3-m7g2","aliases":["CGA-4jcq-82w3-m7g2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jcq-82w3-m7g2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:28Z"}]}}],"modified":"2026-10-02T18:28:00.022235324Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f38333a9-d5c6-4684-92fb-65d6d441dca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jcq-82w3-m7g2","advisory_id":"f38333a9-d5c6-4684-92fb-65d6d441dca1","event_types":["advisory"],"published_at":"2026-10-25T22:45:00.269666+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:53:33+00:00","detail_url":"/events/71303"},"members":[{"id":71303,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-4jcq-82w3-m7g2","summary":"CGA-4jcq-82w3-m7g2","evidence":"osv:CGA-4jcq-82w3-m7g2","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-4jcq-82w3-m7g2","aliases":["CGA-4jcq-82w3-m7g2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4jcq-82w3-m7g2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:28Z"}]}}],"modified":"2026-10-02T18:28:00.022235324Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f38333a9-d5c6-4684-92fb-65d6d441dca1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4jcq-82w3-m7g2","advisory_id":"f38333a9-d5c6-4684-92fb-65d6d441dca1","event_types":["advisory"],"published_at":"2026-10-25T22:45:00.269666+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:53:33+00:00","detail_url":"/events/71303"}]}},{"id":70926,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wh5g-9pqr-559w","summary":"CGA-wh5g-9pqr-559w","evidence":"osv:CGA-wh5g-9pqr-559w","products":[{"name":{"value":"datadog-agent-7.82-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wh5g-9pqr-559w","aliases":["CGA-wh5g-9pqr-559w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.82-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh5g-9pqr-559w.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T21:10:08Z"}]}}],"modified":"2026-10-02T18:27:58.767106736Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c30b719d-3e40-42a3-b645-62fe8c23e0a0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh5g-9pqr-559w","advisory_id":"c30b719d-3e40-42a3-b645-62fe8c23e0a0","event_types":["advisory"],"published_at":"2026-10-25T22:44:45.705608+00:00","technologies":["core-osv","datadog-agent-7-82-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:59:50+00:00","detail_url":"/advisories/advisory%3Ac30b719d-3e40-42a3-b645-62fe8c23e0a0","group":{"id":"advisory:c30b719d-3e40-42a3-b645-62fe8c23e0a0","revision":1,"primary_event_id":71297,"change":"published","superseded_by":[],"changed":{"id":71297,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wh5g-9pqr-559w","summary":"CGA-wh5g-9pqr-559w","evidence":"osv:CGA-wh5g-9pqr-559w","products":[{"name":{"value":"datadog-agent-7.82-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wh5g-9pqr-559w","aliases":["CGA-wh5g-9pqr-559w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.82-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh5g-9pqr-559w.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T21:10:08Z"}]}}],"modified":"2026-10-02T18:27:58.767106736Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c30b719d-3e40-42a3-b645-62fe8c23e0a0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh5g-9pqr-559w","advisory_id":"c30b719d-3e40-42a3-b645-62fe8c23e0a0","event_types":["advisory"],"published_at":"2026-10-25T22:44:45.705608+00:00","technologies":["core-osv","datadog-agent-7-82-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:59:50+00:00","detail_url":"/events/71297"},"members":[{"id":71297,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wh5g-9pqr-559w","summary":"CGA-wh5g-9pqr-559w","evidence":"osv:CGA-wh5g-9pqr-559w","products":[{"name":{"value":"datadog-agent-7.82-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wh5g-9pqr-559w","aliases":["CGA-wh5g-9pqr-559w"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.82-serverless-init?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wh5g-9pqr-559w.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T21:10:08Z"}]}}],"modified":"2026-10-02T18:27:58.767106736Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:c30b719d-3e40-42a3-b645-62fe8c23e0a0","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wh5g-9pqr-559w","advisory_id":"c30b719d-3e40-42a3-b645-62fe8c23e0a0","event_types":["advisory"],"published_at":"2026-10-25T22:44:45.705608+00:00","technologies":["core-osv","datadog-agent-7-82-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:59:50+00:00","detail_url":"/events/71297"}]}},{"id":70918,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-3pw3-8wcw-x7gv","summary":"CGA-3pw3-8wcw-x7gv","evidence":"osv:CGA-3pw3-8wcw-x7gv","products":[{"name":{"value":"grafana-12.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"grafana-12.3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3pw3-8wcw-x7gv","aliases":["CGA-3pw3-8wcw-x7gv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/chainguard/grafana-12.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/wolfi/grafana-12.3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}}],"modified":"2026-10-02T18:27:56.296226454Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:067fa29b-648e-47c2-b142-c821473f4b36","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3pw3-8wcw-x7gv","advisory_id":"067fa29b-648e-47c2-b142-c821473f4b36","event_types":["advisory"],"published_at":"2026-10-25T22:44:36.234524+00:00","technologies":["core-osv","grafana-12-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:56:03+00:00","detail_url":"/advisories/advisory%3A067fa29b-648e-47c2-b142-c821473f4b36","group":{"id":"advisory:067fa29b-648e-47c2-b142-c821473f4b36","revision":1,"primary_event_id":71289,"change":"published","superseded_by":[],"changed":{"id":71289,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-3pw3-8wcw-x7gv","summary":"CGA-3pw3-8wcw-x7gv","evidence":"osv:CGA-3pw3-8wcw-x7gv","products":[{"name":{"value":"grafana-12.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"grafana-12.3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3pw3-8wcw-x7gv","aliases":["CGA-3pw3-8wcw-x7gv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/chainguard/grafana-12.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/wolfi/grafana-12.3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}}],"modified":"2026-10-02T18:27:56.296226454Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:067fa29b-648e-47c2-b142-c821473f4b36","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3pw3-8wcw-x7gv","advisory_id":"067fa29b-648e-47c2-b142-c821473f4b36","event_types":["advisory"],"published_at":"2026-10-25T22:44:36.234524+00:00","technologies":["core-osv","grafana-12-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:56:03+00:00","detail_url":"/events/71289"},"members":[{"id":71289,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-3pw3-8wcw-x7gv","summary":"CGA-3pw3-8wcw-x7gv","evidence":"osv:CGA-3pw3-8wcw-x7gv","products":[{"name":{"value":"grafana-12.3","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"grafana-12.3","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"12.3.11-r8","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-3pw3-8wcw-x7gv","aliases":["CGA-3pw3-8wcw-x7gv"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/chainguard/grafana-12.3?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.3.11-r8"}]}],"package":{"name":"grafana-12.3","purl":"pkg:apk/wolfi/grafana-12.3?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-3pw3-8wcw-x7gv.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.12.2","component_type":"go-module","component_version":"v0.12.2","component_location":"/usr/bin/grafana","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T02:09:27Z"}]}}],"modified":"2026-10-02T18:27:56.296226454Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:067fa29b-648e-47c2-b142-c821473f4b36","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-3pw3-8wcw-x7gv","advisory_id":"067fa29b-648e-47c2-b142-c821473f4b36","event_types":["advisory"],"published_at":"2026-10-25T22:44:36.234524+00:00","technologies":["core-osv","grafana-12-3"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:56:03+00:00","detail_url":"/events/71289"}]}},{"id":70917,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-32ch-rw9j-4r4g","summary":"CGA-32ch-rw9j-4r4g","evidence":"osv:CGA-32ch-rw9j-4r4g","products":[{"name":{"value":"datadog-agent-fips-7.78","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-32ch-rw9j-4r4g","aliases":["CGA-32ch-rw9j-4r4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.78","purl":"pkg:apk/chainguard/datadog-agent-fips-7.78?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-32ch-rw9j-4r4g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:37:25Z"}]}}],"modified":"2026-10-02T18:27:56.105436809Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:76635f9b-078f-422f-ba19-e40bf4fa184f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-32ch-rw9j-4r4g","advisory_id":"76635f9b-078f-422f-ba19-e40bf4fa184f","event_types":["advisory"],"published_at":"2026-10-25T22:44:35.085743+00:00","technologies":["core-osv","datadog-agent-fips-7-78"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:15+00:00","detail_url":"/advisories/advisory%3A76635f9b-078f-422f-ba19-e40bf4fa184f","group":{"id":"advisory:76635f9b-078f-422f-ba19-e40bf4fa184f","revision":1,"primary_event_id":71288,"change":"published","superseded_by":[],"changed":{"id":71288,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-32ch-rw9j-4r4g","summary":"CGA-32ch-rw9j-4r4g","evidence":"osv:CGA-32ch-rw9j-4r4g","products":[{"name":{"value":"datadog-agent-fips-7.78","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-32ch-rw9j-4r4g","aliases":["CGA-32ch-rw9j-4r4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.78","purl":"pkg:apk/chainguard/datadog-agent-fips-7.78?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-32ch-rw9j-4r4g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:37:25Z"}]}}],"modified":"2026-10-02T18:27:56.105436809Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:76635f9b-078f-422f-ba19-e40bf4fa184f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-32ch-rw9j-4r4g","advisory_id":"76635f9b-078f-422f-ba19-e40bf4fa184f","event_types":["advisory"],"published_at":"2026-10-25T22:44:35.085743+00:00","technologies":["core-osv","datadog-agent-fips-7-78"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:15+00:00","detail_url":"/events/71288"},"members":[{"id":71288,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-32ch-rw9j-4r4g","summary":"CGA-32ch-rw9j-4r4g","evidence":"osv:CGA-32ch-rw9j-4r4g","products":[{"name":{"value":"datadog-agent-fips-7.78","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-32ch-rw9j-4r4g","aliases":["CGA-32ch-rw9j-4r4g"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.78","purl":"pkg:apk/chainguard/datadog-agent-fips-7.78?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-32ch-rw9j-4r4g.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:37:25Z"}]}}],"modified":"2026-10-02T18:27:56.105436809Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:76635f9b-078f-422f-ba19-e40bf4fa184f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-32ch-rw9j-4r4g","advisory_id":"76635f9b-078f-422f-ba19-e40bf4fa184f","event_types":["advisory"],"published_at":"2026-10-25T22:44:35.085743+00:00","technologies":["core-osv","datadog-agent-fips-7-78"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:46:15+00:00","detail_url":"/events/71288"}]}},{"id":70889,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-67f3-5gg4-jrp2","summary":"CGA-67f3-5gg4-jrp2","evidence":"osv:CGA-67f3-5gg4-jrp2","products":[{"name":{"value":"traefik-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"traefik-3.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67f3-5gg4-jrp2","aliases":["CGA-67f3-5gg4-jrp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/chainguard/traefik-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/wolfi/traefik-3.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}}],"modified":"2026-10-02T18:27:49.170591281Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67f3-5gg4-jrp2","advisory_id":"b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","event_types":["advisory"],"published_at":"2026-10-25T22:44:03.380984+00:00","technologies":["core-osv","traefik-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:48:55+00:00","detail_url":"/advisories/advisory%3Ab221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","group":{"id":"advisory:b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","revision":1,"primary_event_id":71260,"change":"published","superseded_by":[],"changed":{"id":71260,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-67f3-5gg4-jrp2","summary":"CGA-67f3-5gg4-jrp2","evidence":"osv:CGA-67f3-5gg4-jrp2","products":[{"name":{"value":"traefik-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"traefik-3.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67f3-5gg4-jrp2","aliases":["CGA-67f3-5gg4-jrp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/chainguard/traefik-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/wolfi/traefik-3.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}}],"modified":"2026-10-02T18:27:49.170591281Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67f3-5gg4-jrp2","advisory_id":"b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","event_types":["advisory"],"published_at":"2026-10-25T22:44:03.380984+00:00","technologies":["core-osv","traefik-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:48:55+00:00","detail_url":"/events/71260"},"members":[{"id":71260,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-67f3-5gg4-jrp2","summary":"CGA-67f3-5gg4-jrp2","evidence":"osv:CGA-67f3-5gg4-jrp2","products":[{"name":{"value":"traefik-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"traefik-3.6","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-67f3-5gg4-jrp2","aliases":["CGA-67f3-5gg4-jrp2"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/chainguard/traefik-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-3.6","purl":"pkg:apk/wolfi/traefik-3.6?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-67f3-5gg4-jrp2.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:03:10Z"}]}}],"modified":"2026-10-02T18:27:49.170591281Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-67f3-5gg4-jrp2","advisory_id":"b221e5bc-2f32-4b7b-9eb0-f8c0a0bd9d7d","event_types":["advisory"],"published_at":"2026-10-25T22:44:03.380984+00:00","technologies":["core-osv","traefik-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T11:48:55+00:00","detail_url":"/events/71260"}]}},{"id":70886,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vxrg-rv9f-jq79","summary":"CGA-vxrg-rv9f-jq79","evidence":"osv:CGA-vxrg-rv9f-jq79","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vxrg-rv9f-jq79","aliases":["CGA-vxrg-rv9f-jq79"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}}],"modified":"2026-10-02T18:27:48.490658670Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:160e12f2-ec92-414a-acd1-622e4bf2ef64","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vxrg-rv9f-jq79","advisory_id":"160e12f2-ec92-414a-acd1-622e4bf2ef64","event_types":["advisory"],"published_at":"2026-10-25T22:44:00.727991+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:20+00:00","detail_url":"/advisories/advisory%3A160e12f2-ec92-414a-acd1-622e4bf2ef64","group":{"id":"advisory:160e12f2-ec92-414a-acd1-622e4bf2ef64","revision":1,"primary_event_id":71257,"change":"published","superseded_by":[],"changed":{"id":71257,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vxrg-rv9f-jq79","summary":"CGA-vxrg-rv9f-jq79","evidence":"osv:CGA-vxrg-rv9f-jq79","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vxrg-rv9f-jq79","aliases":["CGA-vxrg-rv9f-jq79"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}}],"modified":"2026-10-02T18:27:48.490658670Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:160e12f2-ec92-414a-acd1-622e4bf2ef64","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vxrg-rv9f-jq79","advisory_id":"160e12f2-ec92-414a-acd1-622e4bf2ef64","event_types":["advisory"],"published_at":"2026-10-25T22:44:00.727991+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:20+00:00","detail_url":"/events/71257"},"members":[{"id":71257,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-vxrg-rv9f-jq79","summary":"CGA-vxrg-rv9f-jq79","evidence":"osv:CGA-vxrg-rv9f-jq79","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-vxrg-rv9f-jq79","aliases":["CGA-vxrg-rv9f-jq79"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-vxrg-rv9f-jq79.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:29:29Z"}]}}],"modified":"2026-10-02T18:27:48.490658670Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:160e12f2-ec92-414a-acd1-622e4bf2ef64","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-vxrg-rv9f-jq79","advisory_id":"160e12f2-ec92-414a-acd1-622e4bf2ef64","event_types":["advisory"],"published_at":"2026-10-25T22:44:00.727991+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:23:20+00:00","detail_url":"/events/71257"}]}},{"id":70882,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-rp7p-4x86-r53v","summary":"CGA-rp7p-4x86-r53v","evidence":"osv:CGA-rp7p-4x86-r53v","products":[{"name":{"value":"traefik-fips-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rp7p-4x86-r53v","aliases":["CGA-rp7p-4x86-r53v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-fips-3.6","purl":"pkg:apk/chainguard/traefik-fips-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rp7p-4x86-r53v.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:55Z"}]}}],"modified":"2026-10-02T18:27:47.358186437Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ce68647e-5720-4c3a-85cb-8b0357628462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rp7p-4x86-r53v","advisory_id":"ce68647e-5720-4c3a-85cb-8b0357628462","event_types":["advisory"],"published_at":"2026-10-25T22:43:52.400263+00:00","technologies":["core-osv","traefik-fips-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T08:12:13+00:00","detail_url":"/advisories/advisory%3Ace68647e-5720-4c3a-85cb-8b0357628462","group":{"id":"advisory:ce68647e-5720-4c3a-85cb-8b0357628462","revision":1,"primary_event_id":71253,"change":"published","superseded_by":[],"changed":{"id":71253,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-rp7p-4x86-r53v","summary":"CGA-rp7p-4x86-r53v","evidence":"osv:CGA-rp7p-4x86-r53v","products":[{"name":{"value":"traefik-fips-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rp7p-4x86-r53v","aliases":["CGA-rp7p-4x86-r53v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-fips-3.6","purl":"pkg:apk/chainguard/traefik-fips-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rp7p-4x86-r53v.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:55Z"}]}}],"modified":"2026-10-02T18:27:47.358186437Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ce68647e-5720-4c3a-85cb-8b0357628462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rp7p-4x86-r53v","advisory_id":"ce68647e-5720-4c3a-85cb-8b0357628462","event_types":["advisory"],"published_at":"2026-10-25T22:43:52.400263+00:00","technologies":["core-osv","traefik-fips-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T08:12:13+00:00","detail_url":"/events/71253"},"members":[{"id":71253,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-rp7p-4x86-r53v","summary":"CGA-rp7p-4x86-r53v","evidence":"osv:CGA-rp7p-4x86-r53v","products":[{"name":{"value":"traefik-fips-3.6","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rp7p-4x86-r53v","aliases":["CGA-rp7p-4x86-r53v"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"traefik-fips-3.6","purl":"pkg:apk/chainguard/traefik-fips-3.6?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rp7p-4x86-r53v.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/usr/bin/traefik","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:42:55Z"}]}}],"modified":"2026-10-02T18:27:47.358186437Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:ce68647e-5720-4c3a-85cb-8b0357628462","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rp7p-4x86-r53v","advisory_id":"ce68647e-5720-4c3a-85cb-8b0357628462","event_types":["advisory"],"published_at":"2026-10-25T22:43:52.400263+00:00","technologies":["core-osv","traefik-fips-3-6"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T08:12:13+00:00","detail_url":"/events/71253"}]}},{"id":70831,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-xm3q-r4jq-7pm5","summary":"CGA-xm3q-r4jq-7pm5","evidence":"osv:CGA-xm3q-r4jq-7pm5","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xm3q-r4jq-7pm5","aliases":["CGA-xm3q-r4jq-7pm5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xm3q-r4jq-7pm5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T20:20:54Z"}]}}],"modified":"2026-10-02T18:25:48.303247858Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e7ff8637-2a7c-48c4-b39a-c883215688c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xm3q-r4jq-7pm5","advisory_id":"e7ff8637-2a7c-48c4-b39a-c883215688c9","event_types":["advisory"],"published_at":"2026-10-25T22:41:25.725549+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:41+00:00","detail_url":"/advisories/advisory%3Ae7ff8637-2a7c-48c4-b39a-c883215688c9","group":{"id":"advisory:e7ff8637-2a7c-48c4-b39a-c883215688c9","revision":1,"primary_event_id":71202,"change":"published","superseded_by":[],"changed":{"id":71202,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-xm3q-r4jq-7pm5","summary":"CGA-xm3q-r4jq-7pm5","evidence":"osv:CGA-xm3q-r4jq-7pm5","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xm3q-r4jq-7pm5","aliases":["CGA-xm3q-r4jq-7pm5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xm3q-r4jq-7pm5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T20:20:54Z"}]}}],"modified":"2026-10-02T18:25:48.303247858Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e7ff8637-2a7c-48c4-b39a-c883215688c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xm3q-r4jq-7pm5","advisory_id":"e7ff8637-2a7c-48c4-b39a-c883215688c9","event_types":["advisory"],"published_at":"2026-10-25T22:41:25.725549+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:41+00:00","detail_url":"/events/71202"},"members":[{"id":71202,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-xm3q-r4jq-7pm5","summary":"CGA-xm3q-r4jq-7pm5","evidence":"osv:CGA-xm3q-r4jq-7pm5","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-xm3q-r4jq-7pm5","aliases":["CGA-xm3q-r4jq-7pm5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-xm3q-r4jq-7pm5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T20:20:54Z"}]}}],"modified":"2026-10-02T18:25:48.303247858Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:e7ff8637-2a7c-48c4-b39a-c883215688c9","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-xm3q-r4jq-7pm5","advisory_id":"e7ff8637-2a7c-48c4-b39a-c883215688c9","event_types":["advisory"],"published_at":"2026-10-25T22:41:25.725549+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:06:41+00:00","detail_url":"/events/71202"}]}},{"id":70751,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-v97p-hppj-x7v5","summary":"CGA-v97p-hppj-x7v5","evidence":"osv:CGA-v97p-hppj-x7v5","products":[{"name":{"value":"datadog-agent-fips-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v97p-hppj-x7v5","aliases":["CGA-v97p-hppj-x7v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-fips-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v97p-hppj-x7v5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:32:12Z"}]}}],"modified":"2026-10-02T18:25:44.298122998Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1347395c-0538-4d69-bf5e-c4c5c370b9b1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v97p-hppj-x7v5","advisory_id":"1347395c-0538-4d69-bf5e-c4c5c370b9b1","event_types":["advisory"],"published_at":"2026-10-25T22:37:38.378577+00:00","technologies":["core-osv","datadog-agent-fips-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:40:09+00:00","detail_url":"/advisories/advisory%3A1347395c-0538-4d69-bf5e-c4c5c370b9b1","group":{"id":"advisory:1347395c-0538-4d69-bf5e-c4c5c370b9b1","revision":1,"primary_event_id":71122,"change":"published","superseded_by":[],"changed":{"id":71122,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-v97p-hppj-x7v5","summary":"CGA-v97p-hppj-x7v5","evidence":"osv:CGA-v97p-hppj-x7v5","products":[{"name":{"value":"datadog-agent-fips-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v97p-hppj-x7v5","aliases":["CGA-v97p-hppj-x7v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-fips-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v97p-hppj-x7v5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:32:12Z"}]}}],"modified":"2026-10-02T18:25:44.298122998Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1347395c-0538-4d69-bf5e-c4c5c370b9b1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v97p-hppj-x7v5","advisory_id":"1347395c-0538-4d69-bf5e-c4c5c370b9b1","event_types":["advisory"],"published_at":"2026-10-25T22:37:38.378577+00:00","technologies":["core-osv","datadog-agent-fips-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:40:09+00:00","detail_url":"/events/71122"},"members":[{"id":71122,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-v97p-hppj-x7v5","summary":"CGA-v97p-hppj-x7v5","evidence":"osv:CGA-v97p-hppj-x7v5","products":[{"name":{"value":"datadog-agent-fips-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-v97p-hppj-x7v5","aliases":["CGA-v97p-hppj-x7v5"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-fips-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-fips-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-v97p-hppj-x7v5.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T13:32:12Z"}]}}],"modified":"2026-10-02T18:25:44.298122998Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1347395c-0538-4d69-bf5e-c4c5c370b9b1","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-v97p-hppj-x7v5","advisory_id":"1347395c-0538-4d69-bf5e-c4c5c370b9b1","event_types":["advisory"],"published_at":"2026-10-25T22:37:38.378577+00:00","technologies":["core-osv","datadog-agent-fips-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:40:09+00:00","detail_url":"/events/71122"}]}},{"id":70471,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-98rh-9gp5-rp77","summary":"CGA-98rh-9gp5-rp77","evidence":"osv:CGA-98rh-9gp5-rp77","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98rh-9gp5-rp77","aliases":["CGA-98rh-9gp5-rp77"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}}],"modified":"2026-10-02T18:25:30.468042553Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f31ed6c5-46e1-4a5a-8828-4f0703078c6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98rh-9gp5-rp77","advisory_id":"f31ed6c5-46e1-4a5a-8828-4f0703078c6d","event_types":["advisory"],"published_at":"2026-10-25T22:25:58.889213+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:30+00:00","detail_url":"/advisories/advisory%3Af31ed6c5-46e1-4a5a-8828-4f0703078c6d","group":{"id":"advisory:f31ed6c5-46e1-4a5a-8828-4f0703078c6d","revision":1,"primary_event_id":70841,"change":"published","superseded_by":[],"changed":{"id":70841,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-98rh-9gp5-rp77","summary":"CGA-98rh-9gp5-rp77","evidence":"osv:CGA-98rh-9gp5-rp77","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98rh-9gp5-rp77","aliases":["CGA-98rh-9gp5-rp77"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}}],"modified":"2026-10-02T18:25:30.468042553Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f31ed6c5-46e1-4a5a-8828-4f0703078c6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98rh-9gp5-rp77","advisory_id":"f31ed6c5-46e1-4a5a-8828-4f0703078c6d","event_types":["advisory"],"published_at":"2026-10-25T22:25:58.889213+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:30+00:00","detail_url":"/events/70841"},"members":[{"id":70841,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-98rh-9gp5-rp77","summary":"CGA-98rh-9gp5-rp77","evidence":"osv:CGA-98rh-9gp5-rp77","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-98rh-9gp5-rp77","aliases":["CGA-98rh-9gp5-rp77"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-98rh-9gp5-rp77.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:07:43Z"}]}}],"modified":"2026-10-02T18:25:30.468042553Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:f31ed6c5-46e1-4a5a-8828-4f0703078c6d","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-98rh-9gp5-rp77","advisory_id":"f31ed6c5-46e1-4a5a-8828-4f0703078c6d","event_types":["advisory"],"published_at":"2026-10-25T22:25:58.889213+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:01:30+00:00","detail_url":"/events/70841"}]}},{"id":70447,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-w92g-9w6r-rcx7","summary":"CGA-w92g-9w6r-rcx7","evidence":"osv:CGA-w92g-9w6r-rcx7","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w92g-9w6r-rcx7","aliases":["CGA-w92g-9w6r-rcx7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w92g-9w6r-rcx7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:11:09Z"}]}}],"modified":"2026-10-02T18:25:29.063634875Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:273284fc-c799-4793-ae4e-32f26b4d462b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w92g-9w6r-rcx7","advisory_id":"273284fc-c799-4793-ae4e-32f26b4d462b","event_types":["advisory"],"published_at":"2026-10-25T22:25:08.151115+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:41:17+00:00","detail_url":"/advisories/advisory%3A273284fc-c799-4793-ae4e-32f26b4d462b","group":{"id":"advisory:273284fc-c799-4793-ae4e-32f26b4d462b","revision":1,"primary_event_id":70817,"change":"published","superseded_by":[],"changed":{"id":70817,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-w92g-9w6r-rcx7","summary":"CGA-w92g-9w6r-rcx7","evidence":"osv:CGA-w92g-9w6r-rcx7","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w92g-9w6r-rcx7","aliases":["CGA-w92g-9w6r-rcx7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w92g-9w6r-rcx7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:11:09Z"}]}}],"modified":"2026-10-02T18:25:29.063634875Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:273284fc-c799-4793-ae4e-32f26b4d462b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w92g-9w6r-rcx7","advisory_id":"273284fc-c799-4793-ae4e-32f26b4d462b","event_types":["advisory"],"published_at":"2026-10-25T22:25:08.151115+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:41:17+00:00","detail_url":"/events/70817"},"members":[{"id":70817,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-w92g-9w6r-rcx7","summary":"CGA-w92g-9w6r-rcx7","evidence":"osv:CGA-w92g-9w6r-rcx7","products":[{"name":{"value":"datadog-agent-7.77-serverless-init","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-w92g-9w6r-rcx7","aliases":["CGA-w92g-9w6r-rcx7"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-serverless-init","purl":"pkg:apk/chainguard/datadog-agent-7.77-serverless-init?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-w92g-9w6r-rcx7.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/datadog-init","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T03:11:09Z"}]}}],"modified":"2026-10-02T18:25:29.063634875Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:273284fc-c799-4793-ae4e-32f26b4d462b","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-w92g-9w6r-rcx7","advisory_id":"273284fc-c799-4793-ae4e-32f26b4d462b","event_types":["advisory"],"published_at":"2026-10-25T22:25:08.151115+00:00","technologies":["core-osv","datadog-agent-7-77-serverless-init"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:41:17+00:00","detail_url":"/events/70817"}]}},{"id":70350,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-7465-9742-3ffr","summary":"CGA-7465-9742-3ffr","evidence":"osv:CGA-7465-9742-3ffr","products":[{"name":{"value":"datadog-agent-7.79","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7465-9742-3ffr","aliases":["CGA-7465-9742-3ffr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/chainguard/datadog-agent-7.79?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/wolfi/datadog-agent-7.79?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}}],"modified":"2026-10-02T18:25:24.550145388Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2bb0904b-9e18-4144-944e-fc35ea737998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7465-9742-3ffr","advisory_id":"2bb0904b-9e18-4144-944e-fc35ea737998","event_types":["advisory"],"published_at":"2026-10-25T22:21:57.439203+00:00","technologies":["core-osv","datadog-agent-7-79"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:34:03+00:00","detail_url":"/advisories/advisory%3A2bb0904b-9e18-4144-944e-fc35ea737998","group":{"id":"advisory:2bb0904b-9e18-4144-944e-fc35ea737998","revision":1,"primary_event_id":70720,"change":"published","superseded_by":[],"changed":{"id":70720,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-7465-9742-3ffr","summary":"CGA-7465-9742-3ffr","evidence":"osv:CGA-7465-9742-3ffr","products":[{"name":{"value":"datadog-agent-7.79","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7465-9742-3ffr","aliases":["CGA-7465-9742-3ffr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/chainguard/datadog-agent-7.79?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/wolfi/datadog-agent-7.79?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}}],"modified":"2026-10-02T18:25:24.550145388Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2bb0904b-9e18-4144-944e-fc35ea737998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7465-9742-3ffr","advisory_id":"2bb0904b-9e18-4144-944e-fc35ea737998","event_types":["advisory"],"published_at":"2026-10-25T22:21:57.439203+00:00","technologies":["core-osv","datadog-agent-7-79"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:34:03+00:00","detail_url":"/events/70720"},"members":[{"id":70720,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-7465-9742-3ffr","summary":"CGA-7465-9742-3ffr","evidence":"osv:CGA-7465-9742-3ffr","products":[{"name":{"value":"datadog-agent-7.79","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-7465-9742-3ffr","aliases":["CGA-7465-9742-3ffr"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/chainguard/datadog-agent-7.79?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79","purl":"pkg:apk/wolfi/datadog-agent-7.79?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7465-9742-3ffr.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T02:23:29Z"}]}}],"modified":"2026-10-02T18:25:24.550145388Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:2bb0904b-9e18-4144-944e-fc35ea737998","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-7465-9742-3ffr","advisory_id":"2bb0904b-9e18-4144-944e-fc35ea737998","event_types":["advisory"],"published_at":"2026-10-25T22:21:57.439203+00:00","technologies":["core-osv","datadog-agent-7-79"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:34:03+00:00","detail_url":"/events/70720"}]}},{"id":70317,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-g8r6-vv87-r6m8","summary":"CGA-g8r6-vv87-r6m8","evidence":"osv:CGA-g8r6-vv87-r6m8","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8r6-vv87-r6m8","aliases":["CGA-g8r6-vv87-r6m8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8r6-vv87-r6m8.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:09:57Z"}]}}],"modified":"2026-10-02T18:25:23.031205549Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:54f4c450-283a-43c0-a731-8fd7a4ddd1ab","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8r6-vv87-r6m8","advisory_id":"54f4c450-283a-43c0-a731-8fd7a4ddd1ab","event_types":["advisory"],"published_at":"2026-10-25T22:21:01.694521+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:49:25+00:00","detail_url":"/advisories/advisory%3A54f4c450-283a-43c0-a731-8fd7a4ddd1ab","group":{"id":"advisory:54f4c450-283a-43c0-a731-8fd7a4ddd1ab","revision":1,"primary_event_id":70687,"change":"published","superseded_by":[],"changed":{"id":70687,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-g8r6-vv87-r6m8","summary":"CGA-g8r6-vv87-r6m8","evidence":"osv:CGA-g8r6-vv87-r6m8","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8r6-vv87-r6m8","aliases":["CGA-g8r6-vv87-r6m8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8r6-vv87-r6m8.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:09:57Z"}]}}],"modified":"2026-10-02T18:25:23.031205549Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:54f4c450-283a-43c0-a731-8fd7a4ddd1ab","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8r6-vv87-r6m8","advisory_id":"54f4c450-283a-43c0-a731-8fd7a4ddd1ab","event_types":["advisory"],"published_at":"2026-10-25T22:21:01.694521+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:49:25+00:00","detail_url":"/events/70687"},"members":[{"id":70687,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-g8r6-vv87-r6m8","summary":"CGA-g8r6-vv87-r6m8","evidence":"osv:CGA-g8r6-vv87-r6m8","products":[{"name":{"value":"datadog-agent-7.82-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-g8r6-vv87-r6m8","aliases":["CGA-g8r6-vv87-r6m8"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.82-full","purl":"pkg:apk/chainguard/datadog-agent-7.82-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-g8r6-vv87-r6m8.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-01T14:09:57Z"}]}}],"modified":"2026-10-02T18:25:23.031205549Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:54f4c450-283a-43c0-a731-8fd7a4ddd1ab","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-g8r6-vv87-r6m8","advisory_id":"54f4c450-283a-43c0-a731-8fd7a4ddd1ab","event_types":["advisory"],"published_at":"2026-10-25T22:21:01.694521+00:00","technologies":["core-osv","datadog-agent-7-82-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:49:25+00:00","detail_url":"/events/70687"}]}},{"id":67627,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wg7h-33r8-34qw","summary":"CGA-wg7h-33r8-34qw","evidence":"osv:CGA-wg7h-33r8-34qw","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wg7h-33r8-34qw","aliases":["CGA-wg7h-33r8-34qw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}}],"modified":"2026-10-02T11:00:14.259424796Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:444e804c-c36a-4c45-a98d-bbb714d86d38","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wg7h-33r8-34qw","advisory_id":"444e804c-c36a-4c45-a98d-bbb714d86d38","event_types":["advisory"],"published_at":"2026-10-25T21:19:54.765685+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:53:30+00:00","detail_url":"/advisories/advisory%3A444e804c-c36a-4c45-a98d-bbb714d86d38","group":{"id":"advisory:444e804c-c36a-4c45-a98d-bbb714d86d38","revision":1,"primary_event_id":67997,"change":"published","superseded_by":[],"changed":{"id":67997,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wg7h-33r8-34qw","summary":"CGA-wg7h-33r8-34qw","evidence":"osv:CGA-wg7h-33r8-34qw","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wg7h-33r8-34qw","aliases":["CGA-wg7h-33r8-34qw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}}],"modified":"2026-10-02T11:00:14.259424796Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:444e804c-c36a-4c45-a98d-bbb714d86d38","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wg7h-33r8-34qw","advisory_id":"444e804c-c36a-4c45-a98d-bbb714d86d38","event_types":["advisory"],"published_at":"2026-10-25T21:19:54.765685+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:53:30+00:00","detail_url":"/events/67997"},"members":[{"id":67997,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-wg7h-33r8-34qw","summary":"CGA-wg7h-33r8-34qw","evidence":"osv:CGA-wg7h-33r8-34qw","products":[{"name":{"value":"datadog-agent-7.77","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-wg7h-33r8-34qw","aliases":["CGA-wg7h-33r8-34qw"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/chainguard/datadog-agent-7.77?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77","purl":"pkg:apk/wolfi/datadog-agent-7.77?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-wg7h-33r8-34qw.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/bin/agent/agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:07:09Z"}]}}],"modified":"2026-10-02T11:00:14.259424796Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:444e804c-c36a-4c45-a98d-bbb714d86d38","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-wg7h-33r8-34qw","advisory_id":"444e804c-c36a-4c45-a98d-bbb714d86d38","event_types":["advisory"],"published_at":"2026-10-25T21:19:54.765685+00:00","technologies":["core-osv","datadog-agent-7-77"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T12:53:30+00:00","detail_url":"/events/67997"}]}},{"id":67577,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-5pqf-hj2c-vqvc","summary":"CGA-5pqf-hj2c-vqvc","evidence":"osv:CGA-5pqf-hj2c-vqvc","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5pqf-hj2c-vqvc","aliases":["CGA-5pqf-hj2c-vqvc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}}],"modified":"2026-10-02T11:00:08.024317486Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5pqf-hj2c-vqvc","advisory_id":"d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","event_types":["advisory"],"published_at":"2026-10-25T21:19:10.455016+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:30+00:00","detail_url":"/advisories/advisory%3Ad6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","group":{"id":"advisory:d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","revision":1,"primary_event_id":67947,"change":"published","superseded_by":[],"changed":{"id":67947,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-5pqf-hj2c-vqvc","summary":"CGA-5pqf-hj2c-vqvc","evidence":"osv:CGA-5pqf-hj2c-vqvc","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5pqf-hj2c-vqvc","aliases":["CGA-5pqf-hj2c-vqvc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}}],"modified":"2026-10-02T11:00:08.024317486Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5pqf-hj2c-vqvc","advisory_id":"d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","event_types":["advisory"],"published_at":"2026-10-25T21:19:10.455016+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:30+00:00","detail_url":"/events/67947"},"members":[{"id":67947,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-5pqf-hj2c-vqvc","summary":"CGA-5pqf-hj2c-vqvc","evidence":"osv:CGA-5pqf-hj2c-vqvc","products":[{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.77-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-5pqf-hj2c-vqvc","aliases":["CGA-5pqf-hj2c-vqvc"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/chainguard/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.77-full","purl":"pkg:apk/wolfi/datadog-agent-7.77-full?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-5pqf-hj2c-vqvc.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.19.0","component_type":"go-module","component_version":"v0.19.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T04:06:09Z"}]}}],"modified":"2026-10-02T11:00:08.024317486Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-5pqf-hj2c-vqvc","advisory_id":"d6999a8d-9b47-4516-ac5e-2dd5bbac2a2f","event_types":["advisory"],"published_at":"2026-10-25T21:19:10.455016+00:00","technologies":["core-osv","datadog-agent-7-77-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T13:14:30+00:00","detail_url":"/events/67947"}]}},{"id":66546,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-h745-42w5-xq9r","summary":"CGA-h745-42w5-xq9r","evidence":"osv:CGA-h745-42w5-xq9r","products":[{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h745-42w5-xq9r","aliases":["CGA-h745-42w5-xq9r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/chainguard/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/wolfi/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}}],"modified":"2026-10-02T05:17:35.651981689Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h745-42w5-xq9r","advisory_id":"1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","event_types":["advisory"],"published_at":"2026-10-25T21:01:49.261587+00:00","technologies":["core-osv","datadog-agent-7-79-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:41+00:00","detail_url":"/advisories/advisory%3A1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","group":{"id":"advisory:1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","revision":1,"primary_event_id":66916,"change":"published","superseded_by":[],"changed":{"id":66916,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-h745-42w5-xq9r","summary":"CGA-h745-42w5-xq9r","evidence":"osv:CGA-h745-42w5-xq9r","products":[{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h745-42w5-xq9r","aliases":["CGA-h745-42w5-xq9r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/chainguard/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/wolfi/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}}],"modified":"2026-10-02T05:17:35.651981689Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h745-42w5-xq9r","advisory_id":"1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","event_types":["advisory"],"published_at":"2026-10-25T21:01:49.261587+00:00","technologies":["core-osv","datadog-agent-7-79-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:41+00:00","detail_url":"/events/66916"},"members":[{"id":66916,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"CGA-h745-42w5-xq9r","summary":"CGA-h745-42w5-xq9r","evidence":"osv:CGA-h745-42w5-xq9r","products":[{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]},{"name":{"value":"datadog-agent-7.79-full","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-h745-42w5-xq9r","aliases":["CGA-h745-42w5-xq9r"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/chainguard/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"package":{"name":"datadog-agent-7.79-full","purl":"pkg:apk/wolfi/datadog-agent-7.79-full?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-h745-42w5-xq9r.json"},"ecosystem_specific":{"components":[{"component_name":"go.opentelemetry.io/otel/sdk/log","component_purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log@v0.20.0","component_type":"go-module","component_version":"v0.20.0","component_location":"/opt/datadog-agent/embedded/bin/otel-agent","latest_event_status":"fix_not_planned","latest_event_timestamp":"2026-10-02T01:41:17Z"}]}}],"modified":"2026-10-02T05:17:35.651981689Z","provider":"osv","upstream":["CVE-2026-81872","GHSA-hjf4-fphr-2h65"],"references":["https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/81xxx/CVE-2026-81872.json","https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/pull/8620"]},"related_cves":[{"value":"CVE-2026-81872","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-h745-42w5-xq9r","advisory_id":"1ebb25b7-4032-4f6d-b1a6-a9cd1422b0fd","event_types":["advisory"],"published_at":"2026-10-25T21:01:49.261587+00:00","technologies":["core-osv","datadog-agent-7-79-full"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-30T14:44:41+00:00","detail_url":"/events/66916"}]}},{"id":64567,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full","summary":"### Summary A `BatchingProcessor` in `go.opentelemetry.io/otel/sdk/log` can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion. Introduced in commit: 4af9c20 ### Details `NewBatchingProcessor` wraps the exporter with `newBufferExporter(exporter, 1)` (`sdk/log/batch.go:116-122`), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with `b.q.TryDequeue`, calls `b.exporter.EnqueueExport(r)`, and then immediately sends on `b.pollTrigger` whenever `qLen >= b.batchSize` (`sdk/log/batch.go:129-165`). `bufferExporter.EnqueueExport` is non-blocking: it sends to `e.input` if possible and returns `false` in the `default` case when the channel is full (`sdk/log/exporter.go:221-248`). `TryDequeue` leaves `q.len` unchanged when the write callback returns `false` (`sdk/log/batch.go:289-314`). Therefore, while the exporter is backpressured, `EnqueueExport` fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker. ### PoC [validation-artifact.zip](https://github.com/user-attachments/files/27494002/validation-artifact.zip) The validation artifact contains a PoC bundle: - `validation-artifact.tar:main.go`: PoC source. - `validation","evidence":"osv:GHSA-hjf4-fphr-2h65","products":[{"name":{"value":"go.opentelemetry.io/otel/sdk/log","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-hjf4-fphr-2h65","aliases":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}],"package":{"name":"go.opentelemetry.io/otel/sdk/log","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hjf4-fphr-2h65/GHSA-hjf4-fphr-2h65.json"}}],"modified":"2026-10-01T20:56:06.318497338Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"],"provider_metadata":{"cwe_ids":["CWE-400","CWE-834"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-09-16T21:17:22Z","github_reviewed_at":"2026-09-29T17:59:53Z"}},"related_cves":[{"value":"CVE-2026-81872","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hjf4-fphr-2h65","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-hjf4-fphr-2h65","advisory_id":"2e18502f-b4d1-423e-8744-2aee10e79c4c","event_types":["advisory"],"published_at":"2026-10-25T19:52:41.973726+00:00","technologies":["core-osv","go-opentelemetry-io-otel-sdk-log"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T17:59:53+00:00","detail_url":"/advisories/osv%3AGHSA-hjf4-fphr-2h65","group":{"id":"osv:GHSA-hjf4-fphr-2h65","revision":1,"primary_event_id":63937,"change":"published","superseded_by":[],"changed":{"id":63850,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log","summary":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log","evidence":"osv:GO-2026-6615","products":[{"name":{"value":"go.opentelemetry.io/otel/sdk/log","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GO-2026-6615","aliases":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}],"package":{"name":"go.opentelemetry.io/otel/sdk/log","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log","ecosystem":"Go"},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6615.json"},"ecosystem_specific":{}}],"modified":"2026-10-01T20:45:14.982993973Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"],"provider_metadata":{"url":"https://pkg.go.dev/vuln/GO-2026-6615","review_status":"REVIEWED"}},"related_cves":[{"value":"CVE-2026-81872","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hjf4-fphr-2h65","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GO-2026-6615","advisory_id":"a043077a-1d3a-42a0-8026-7a68c5599df5","event_types":["advisory"],"published_at":"2026-10-25T19:51:53.067144+00:00","technologies":["core-osv","go-opentelemetry-io-otel-sdk-log"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T20:24:10+00:00","detail_url":"/events/63850"},"members":[{"id":63850,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log","summary":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full in go.opentelemetry.io/otel/sdk/log","evidence":"osv:GO-2026-6615","products":[{"name":{"value":"go.opentelemetry.io/otel/sdk/log","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GO-2026-6615","aliases":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}],"package":{"name":"go.opentelemetry.io/otel/sdk/log","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log","ecosystem":"Go"},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6615.json"},"ecosystem_specific":{}}],"modified":"2026-10-01T20:45:14.982993973Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"],"provider_metadata":{"url":"https://pkg.go.dev/vuln/GO-2026-6615","review_status":"REVIEWED"}},"related_cves":[{"value":"CVE-2026-81872","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hjf4-fphr-2h65","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GO-2026-6615","advisory_id":"a043077a-1d3a-42a0-8026-7a68c5599df5","event_types":["advisory"],"published_at":"2026-10-25T19:51:53.067144+00:00","technologies":["core-osv","go-opentelemetry-io-otel-sdk-log"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T20:24:10+00:00","detail_url":"/events/63850"},{"id":63937,"cve_ids":["CVE-2026-81872"],"payload":{"kind":"advisory","title":"OpenTelemetry-Go: BatchProcessor can busy-spin when export buffer is full","summary":"### Summary A `BatchingProcessor` in `go.opentelemetry.io/otel/sdk/log` can enter a tight CPU loop when the asynchronous export buffer is full. Under exporter backpressure, attacker-driven high-volume log emission can keep the queue at or above the batch size, causing repeated immediate export retries and a denial of service through CPU exhaustion. Introduced in commit: 4af9c20 ### Details `NewBatchingProcessor` wraps the exporter with `newBufferExporter(exporter, 1)` (`sdk/log/batch.go:116-122`), so the asynchronous export input can fill quickly when the downstream exporter blocks. The poll goroutine dequeues a batch with `b.q.TryDequeue`, calls `b.exporter.EnqueueExport(r)`, and then immediately sends on `b.pollTrigger` whenever `qLen >= b.batchSize` (`sdk/log/batch.go:129-165`). `bufferExporter.EnqueueExport` is non-blocking: it sends to `e.input` if possible and returns `false` in the `default` case when the channel is full (`sdk/log/exporter.go:221-248`). `TryDequeue` leaves `q.len` unchanged when the write callback returns `false` (`sdk/log/batch.go:289-314`). Therefore, while the exporter is backpressured, `EnqueueExport` fails, the queue remains at or above one full batch, and the poll loop continuously retriggers itself without waiting for the ticker. ### PoC [validation-artifact.zip](https://github.com/user-attachments/files/27494002/validation-artifact.zip) The validation artifact contains a PoC bundle: - `validation-artifact.tar:main.go`: PoC source. - `validation","evidence":"osv:GHSA-hjf4-fphr-2h65","products":[{"name":{"value":"go.opentelemetry.io/otel/sdk/log","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"0.21.0","evidence":"/affected/0/ranges"}],"affected_versions":[]}],"severity":"unknown","structured":{"id":"GHSA-hjf4-fphr-2h65","aliases":["CVE-2026-81872","GHSA-hjf4-fphr-2h65","GO-2026-6615"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.21.0"}]}],"package":{"name":"go.opentelemetry.io/otel/sdk/log","purl":"pkg:golang/go.opentelemetry.io/otel/sdk/log","ecosystem":"Go"},"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-hjf4-fphr-2h65/GHSA-hjf4-fphr-2h65.json"}}],"modified":"2026-10-01T20:56:06.318497338Z","provider":"osv","references":["https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-hjf4-fphr-2h65","https://nvd.nist.gov/vuln/detail/CVE-2026-81872","https://github.com/open-telemetry/opentelemetry-go/issues/6797","https://github.com/open-telemetry/opentelemetry-go/pull/8620","https://github.com/open-telemetry/opentelemetry-go/commit/ba71b09e6ed272e93a669aeaec1e98b1df4cc582","https://github.com/open-telemetry/opentelemetry-go","https://github.com/open-telemetry/opentelemetry-go/releases/tag/sdk/log/v0.21.0"],"provider_metadata":{"cwe_ids":["CWE-400","CWE-834"],"severity":"MODERATE","github_reviewed":true,"nvd_published_at":"2026-09-16T21:17:22Z","github_reviewed_at":"2026-09-29T17:59:53Z"}},"related_cves":[{"value":"CVE-2026-81872","evidence":"/aliases"}],"security_relevant":true,"severity_evidence":null},"group_id":"osv:GHSA-hjf4-fphr-2h65","priority":{"reasons":["unrated_security_fix"],"severity":"unknown","linked_cves":[],"fix_available":true,"known_exploited":false,"publisher_severity":"unknown"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/GHSA-hjf4-fphr-2h65","advisory_id":"2e18502f-b4d1-423e-8744-2aee10e79c4c","event_types":["advisory"],"published_at":"2026-10-25T19:52:41.973726+00:00","technologies":["core-osv","go-opentelemetry-io-otel-sdk-log"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-29T17:59:53+00:00","detail_url":"/events/63937"}]}}],"next_after":70943,"next_before":64567}