{"schema_version":"2","view":"grouped","data":[{"id":71759,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-65mr-23c7-v7vm","summary":"CGA-65mr-23c7-v7vm","evidence":"osv:CGA-65mr-23c7-v7vm","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mr-23c7-v7vm","aliases":["CGA-65mr-23c7-v7vm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:01:24.461453093Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mr-23c7-v7vm","advisory_id":"aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","event_types":["advisory"],"published_at":"2026-10-25T23:35:10.579546+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/advisories/advisory%3Aaaf96bbc-b97f-4270-8cc7-7a4503b0e75a","group":{"id":"advisory:aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","revision":1,"primary_event_id":72210,"change":"published","superseded_by":[],"changed":{"id":72210,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-65mr-23c7-v7vm","summary":"CGA-65mr-23c7-v7vm","evidence":"osv:CGA-65mr-23c7-v7vm","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mr-23c7-v7vm","aliases":["CGA-65mr-23c7-v7vm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:01:24.461453093Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mr-23c7-v7vm","advisory_id":"aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","event_types":["advisory"],"published_at":"2026-10-25T23:35:10.579546+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/events/72210"},"members":[{"id":72210,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-65mr-23c7-v7vm","summary":"CGA-65mr-23c7-v7vm","evidence":"osv:CGA-65mr-23c7-v7vm","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-65mr-23c7-v7vm","aliases":["CGA-65mr-23c7-v7vm"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-65mr-23c7-v7vm.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:01:24.461453093Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-65mr-23c7-v7vm","advisory_id":"aaf96bbc-b97f-4270-8cc7-7a4503b0e75a","event_types":["advisory"],"published_at":"2026-10-25T23:35:10.579546+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/events/72210"}]}},{"id":71639,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-rqh5-gwhx-7c67","summary":"CGA-rqh5-gwhx-7c67","evidence":"osv:CGA-rqh5-gwhx-7c67","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rqh5-gwhx-7c67","aliases":["CGA-rqh5-gwhx-7c67"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:01:13.192348554Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c926106-2153-40f0-b07d-aeb3bc398d9b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rqh5-gwhx-7c67","advisory_id":"6c926106-2153-40f0-b07d-aeb3bc398d9b","event_types":["advisory"],"published_at":"2026-10-25T23:25:07.532967+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/advisories/advisory%3A6c926106-2153-40f0-b07d-aeb3bc398d9b","group":{"id":"advisory:6c926106-2153-40f0-b07d-aeb3bc398d9b","revision":1,"primary_event_id":72070,"change":"published","superseded_by":[],"changed":{"id":72070,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-rqh5-gwhx-7c67","summary":"CGA-rqh5-gwhx-7c67","evidence":"osv:CGA-rqh5-gwhx-7c67","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rqh5-gwhx-7c67","aliases":["CGA-rqh5-gwhx-7c67"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:01:13.192348554Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c926106-2153-40f0-b07d-aeb3bc398d9b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rqh5-gwhx-7c67","advisory_id":"6c926106-2153-40f0-b07d-aeb3bc398d9b","event_types":["advisory"],"published_at":"2026-10-25T23:25:07.532967+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/72070"},"members":[{"id":72070,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-rqh5-gwhx-7c67","summary":"CGA-rqh5-gwhx-7c67","evidence":"osv:CGA-rqh5-gwhx-7c67","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-rqh5-gwhx-7c67","aliases":["CGA-rqh5-gwhx-7c67"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-rqh5-gwhx-7c67.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:07Z"}]}}],"modified":"2026-10-02T23:01:13.192348554Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:6c926106-2153-40f0-b07d-aeb3bc398d9b","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-rqh5-gwhx-7c67","advisory_id":"6c926106-2153-40f0-b07d-aeb3bc398d9b","event_types":["advisory"],"published_at":"2026-10-25T23:25:07.532967+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/72070"}]}},{"id":71263,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-575m-j3qf-mgcg","summary":"CGA-575m-j3qf-mgcg","evidence":"osv:CGA-575m-j3qf-mgcg","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-575m-j3qf-mgcg","aliases":["CGA-575m-j3qf-mgcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:00:34.626443685Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-575m-j3qf-mgcg","advisory_id":"cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","event_types":["advisory"],"published_at":"2026-10-25T22:59:35.33421+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:52+00:00","detail_url":"/advisories/advisory%3Acc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","group":{"id":"advisory:cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","revision":1,"primary_event_id":71648,"change":"published","superseded_by":[],"changed":{"id":71648,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-575m-j3qf-mgcg","summary":"CGA-575m-j3qf-mgcg","evidence":"osv:CGA-575m-j3qf-mgcg","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-575m-j3qf-mgcg","aliases":["CGA-575m-j3qf-mgcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:00:34.626443685Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-575m-j3qf-mgcg","advisory_id":"cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","event_types":["advisory"],"published_at":"2026-10-25T22:59:35.33421+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:52+00:00","detail_url":"/events/71648"},"members":[{"id":71648,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-575m-j3qf-mgcg","summary":"CGA-575m-j3qf-mgcg","evidence":"osv:CGA-575m-j3qf-mgcg","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-575m-j3qf-mgcg","aliases":["CGA-575m-j3qf-mgcg"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-575m-j3qf-mgcg.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:41Z"}]}}],"modified":"2026-10-02T23:00:34.626443685Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-575m-j3qf-mgcg","advisory_id":"cc9e4e2d-f54c-4f92-836b-620bcb9f2d3f","event_types":["advisory"],"published_at":"2026-10-25T22:59:35.33421+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:52+00:00","detail_url":"/events/71648"}]}},{"id":71181,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-9rpp-9wjx-gf48","summary":"CGA-9rpp-9wjx-gf48","evidence":"osv:CGA-9rpp-9wjx-gf48","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9rpp-9wjx-gf48","aliases":["CGA-9rpp-9wjx-gf48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}}],"modified":"2026-10-02T23:00:24.772007413Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1adf6080-c974-461b-a9cb-5595539ed371","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rpp-9wjx-gf48","advisory_id":"1adf6080-c974-461b-a9cb-5595539ed371","event_types":["advisory"],"published_at":"2026-10-25T22:54:57.421647+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/advisories/advisory%3A1adf6080-c974-461b-a9cb-5595539ed371","group":{"id":"advisory:1adf6080-c974-461b-a9cb-5595539ed371","revision":1,"primary_event_id":71562,"change":"published","superseded_by":[],"changed":{"id":71562,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-9rpp-9wjx-gf48","summary":"CGA-9rpp-9wjx-gf48","evidence":"osv:CGA-9rpp-9wjx-gf48","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9rpp-9wjx-gf48","aliases":["CGA-9rpp-9wjx-gf48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}}],"modified":"2026-10-02T23:00:24.772007413Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1adf6080-c974-461b-a9cb-5595539ed371","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rpp-9wjx-gf48","advisory_id":"1adf6080-c974-461b-a9cb-5595539ed371","event_types":["advisory"],"published_at":"2026-10-25T22:54:57.421647+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/events/71562"},"members":[{"id":71562,"cve_ids":["CVE-2026-97688"],"payload":{"kind":"advisory","title":"CGA-9rpp-9wjx-gf48","summary":"CGA-9rpp-9wjx-gf48","evidence":"osv:CGA-9rpp-9wjx-gf48","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"medium","structured":{"id":"CGA-9rpp-9wjx-gf48","aliases":["CGA-9rpp-9wjx-gf48"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=aarch64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=aarch64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-9rpp-9wjx-gf48.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T17:40:40Z"}]}}],"modified":"2026-10-02T23:00:24.772007413Z","provider":"osv","upstream":["CVE-2026-97688","GHSA-gh4c-6fx4-qh6g"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97688.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-gh4c-6fx4-qh6g","https://nvd.nist.gov/vuln/detail/CVE-2026-97688","https://github.com/urllib3/urllib3/commit/ea2ad7b21a80da3632f80016526a18864586077f"]},"related_cves":[{"value":"CVE-2026-97688","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1adf6080-c974-461b-a9cb-5595539ed371","priority":{"reasons":[],"severity":"medium","linked_cves":[{"cve":"CVE-2026-97688","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":6.9,"attackVector":"NETWORK","baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"NONE","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97688","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-9rpp-9wjx-gf48","advisory_id":"1adf6080-c974-461b-a9cb-5595539ed371","event_types":["advisory"],"published_at":"2026-10-25T22:54:57.421647+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:19:53+00:00","detail_url":"/events/71562"}]}},{"id":71034,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-59cw-63w3-qqh4","summary":"CGA-59cw-63w3-qqh4","evidence":"osv:CGA-59cw-63w3-qqh4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-59cw-63w3-qqh4","aliases":["CGA-59cw-63w3-qqh4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.499533295Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bf66e8c-8261-4da5-803d-159f15282f71","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-59cw-63w3-qqh4","advisory_id":"1bf66e8c-8261-4da5-803d-159f15282f71","event_types":["advisory"],"published_at":"2026-10-25T22:47:58.343815+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/advisories/advisory%3A1bf66e8c-8261-4da5-803d-159f15282f71","group":{"id":"advisory:1bf66e8c-8261-4da5-803d-159f15282f71","revision":1,"primary_event_id":71408,"change":"published","superseded_by":[],"changed":{"id":71408,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-59cw-63w3-qqh4","summary":"CGA-59cw-63w3-qqh4","evidence":"osv:CGA-59cw-63w3-qqh4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-59cw-63w3-qqh4","aliases":["CGA-59cw-63w3-qqh4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.499533295Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bf66e8c-8261-4da5-803d-159f15282f71","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-59cw-63w3-qqh4","advisory_id":"1bf66e8c-8261-4da5-803d-159f15282f71","event_types":["advisory"],"published_at":"2026-10-25T22:47:58.343815+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/71408"},"members":[{"id":71408,"cve_ids":["CVE-2026-97689"],"payload":{"kind":"advisory","title":"CGA-59cw-63w3-qqh4","summary":"CGA-59cw-63w3-qqh4","evidence":"osv:CGA-59cw-63w3-qqh4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-59cw-63w3-qqh4","aliases":["CGA-59cw-63w3-qqh4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-59cw-63w3-qqh4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.499533295Z","provider":"osv","upstream":["CVE-2026-97689","GHSA-vxq7-64xx-v4gw"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97689.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-vxq7-64xx-v4gw","https://nvd.nist.gov/vuln/detail/CVE-2026-97689","https://github.com/urllib3/urllib3/commit/cd770b059b543be29298ea5c52afb0b1b090f5ed"]},"related_cves":[{"value":"CVE-2026-97689","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:1bf66e8c-8261-4da5-803d-159f15282f71","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97689","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":8.9,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H","userInteraction":"NONE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"NONE","subAvailabilityImpact":"HIGH","vulnAvailabilityImpact":"HIGH","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"NONE"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97689","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-59cw-63w3-qqh4","advisory_id":"1bf66e8c-8261-4da5-803d-159f15282f71","event_types":["advisory"],"published_at":"2026-10-25T22:47:58.343815+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/71408"}]}},{"id":71029,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-4ch4-92vx-4vx4","summary":"CGA-4ch4-92vx-4vx4","evidence":"osv:CGA-4ch4-92vx-4vx4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4ch4-92vx-4vx4","aliases":["CGA-4ch4-92vx-4vx4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.376500057Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:037f0c7f-4da2-4494-ae09-d0d663b1775f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4ch4-92vx-4vx4","advisory_id":"037f0c7f-4da2-4494-ae09-d0d663b1775f","event_types":["advisory"],"published_at":"2026-10-25T22:47:44.323242+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/advisories/advisory%3A037f0c7f-4da2-4494-ae09-d0d663b1775f","group":{"id":"advisory:037f0c7f-4da2-4494-ae09-d0d663b1775f","revision":1,"primary_event_id":71403,"change":"published","superseded_by":[],"changed":{"id":71403,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-4ch4-92vx-4vx4","summary":"CGA-4ch4-92vx-4vx4","evidence":"osv:CGA-4ch4-92vx-4vx4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4ch4-92vx-4vx4","aliases":["CGA-4ch4-92vx-4vx4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.376500057Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:037f0c7f-4da2-4494-ae09-d0d663b1775f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4ch4-92vx-4vx4","advisory_id":"037f0c7f-4da2-4494-ae09-d0d663b1775f","event_types":["advisory"],"published_at":"2026-10-25T22:47:44.323242+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/71403"},"members":[{"id":71403,"cve_ids":["CVE-2026-97687"],"payload":{"kind":"advisory","title":"CGA-4ch4-92vx-4vx4","summary":"CGA-4ch4-92vx-4vx4","evidence":"osv:CGA-4ch4-92vx-4vx4","products":[{"name":{"value":"pypy-3.10","evidence":"/affected/0/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/0/ranges"}],"affected_versions":[]},{"name":{"value":"pypy-3.10","evidence":"/affected/1/package/name"},"prerequisites":[],"fixed_versions":[{"value":"7.3.19-r21","evidence":"/affected/1/ranges"}],"affected_versions":[]}],"severity":"high","structured":{"id":"CGA-4ch4-92vx-4vx4","aliases":["CGA-4ch4-92vx-4vx4"],"metrics":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N"}],"affected":[{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/chainguard/pypy-3.10?arch=x86_64","ecosystem":"Chainguard"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}},{"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.3.19-r21"}]}],"package":{"name":"pypy-3.10","purl":"pkg:apk/wolfi/pypy-3.10?arch=x86_64","ecosystem":"Wolfi"},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-4ch4-92vx-4vx4.json"},"ecosystem_specific":{"components":[{"component_name":"urllib3","component_purl":"pkg:pypi/urllib3@2.7.0","component_type":"python","component_version":"2.7.0","component_location":"/usr/lib/pypy3.10/site-packages/pip/_vendor/vendor.txt","latest_event_status":"fixed","latest_event_timestamp":"2026-10-02T19:48:06Z"}]}}],"modified":"2026-10-02T23:00:08.376500057Z","provider":"osv","upstream":["CVE-2026-97687","GHSA-8988-9cw3-xx77"],"references":["https://github.com/urllib3/urllib3/releases/tag/2.8.0","https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/97xxx/CVE-2026-97687.json","https://github.com/urllib3/urllib3/security/advisories/GHSA-8988-9cw3-xx77","https://nvd.nist.gov/vuln/detail/CVE-2026-97687","https://github.com/urllib3/urllib3/commit/07408cec79d1856d81bb42c74a904a24fdb9e465","https://github.com/urllib3/urllib3/commit/b6447295fff7b38fdffc67e0df9712d60cef3cc3","https://github.com/urllib3/urllib3/pull/5093"]},"related_cves":[{"value":"CVE-2026-97687","evidence":"/upstream"}],"security_relevant":true,"severity_evidence":"/severity/0/score"},"group_id":"advisory:037f0c7f-4da2-4494-ae09-d0d663b1775f","priority":{"reasons":["publisher_severity","linked_severity"],"severity":"high","linked_cves":[{"cve":"CVE-2026-97687","metrics":[{"cvssV4_0":{"version":"4.0","baseScore":7.6,"attackVector":"NETWORK","baseSeverity":"HIGH","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","userInteraction":"PASSIVE","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","subIntegrityImpact":"NONE","vulnIntegrityImpact":"HIGH","subAvailabilityImpact":"NONE","vulnAvailabilityImpact":"NONE","subConfidentialityImpact":"NONE","vulnConfidentialityImpact":"HIGH"}}],"products":[{"name":{"value":"urllib3","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"high","source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-97687","relationship":"advisory","known_exploited":false,"relationship_evidence":"/upstream"}],"fix_available":true,"known_exploited":false,"publisher_severity":"high"},"revision":1,"source_id":"core-osv","source_url":"https://osv.dev/vulnerability/CGA-4ch4-92vx-4vx4","advisory_id":"037f0c7f-4da2-4494-ae09-d0d663b1775f","event_types":["advisory"],"published_at":"2026-10-25T22:47:44.323242+00:00","technologies":["core-osv","pypy-3-10"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-10-01T13:46:04+00:00","detail_url":"/events/71403"}]}}],"next_after":71759,"next_before":71029}