{"metadata": {"vulnerability": "CVE-2026-106072", "count": 56, "kinds": {"milestone": 15, "sighting": 4, "kev": 0, "other": 37}}, "data": [{"timestamp": "2026-10-06T15:00:00.655Z", "date_only": false, "value": "2026-10-06T15:00:00.655Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-106072", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-21T19:00:00Z", "date_only": false, "value": "2026-10-21T19:00:00.000000Z", "kind": "sighting", "label": "Seen", "source": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20261022", "record": "CVE-2026-106072", "field": "creation_timestamp", "uuid": "aafbdbb2-3dca-4d75-9320-b36ef2a68be2", "url": "https://www.hkcert.org/security-bulletin/node-js-multiple-vulnerabilities_20261022"}, {"timestamp": "2026-10-21T20:44:18Z", "date_only": false, "value": "2026-10-21T20:44:18.000000Z", "kind": "sighting", "label": "Seen", "source": "https://gist.github.com/mrice32/2a38780a81509efbbb58dfb5ebaa34c2", "record": "CVE-2026-106072", "field": "creation_timestamp", "uuid": "2c599c2a-a8f3-49e8-a78e-4db1522e1ff6", "content": "# October 2026 security vulnerabilities explained\n\nPublished October 21, 2026. This explains the upstream vulnerabilities behind the Node.js and Rust TLS security updates discussed here. Attack scenarios describe prerequisites and potential impact, not evidence that any particular organization was compromised.\n\n## 1. Brotli decompression can execute attacker code\n\n**CVE-2026-111497 \u2014 Node.js**\n\nBrotli compresses data such as HTTP responses. A crafted compressed stream can make the vulnerable decoder write outside its intended memory region, potentially allowing arbitrary code execution.\n\nAn attacker must get malicious compressed data processed by the application. An outbound HTTP client can be a target too: it might decompress an attacker's response without exposing an inbound web server. Successful execution inherits the application's permissions.\n\nFixed Node release baselines: **22.23.4, 24.22.1, 26.12.1**. [Node security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)\n\n## 2. Unusual IP spellings can bypass certificate-name checks\n\n**CVE-2026-106069, CVE-2026-106072, CVE-2026-105483 \u2014 Node.js**\n\nTLS should verify that the server's certificate authenticates the requested destination. These flaws involve inconsistent handling of nonstandard IP-address spellings, including fullwidth digits in the last CVE.\n\nWith the necessary input and connection control, an attacker could exploit that mismatch to get an inappropriate certificate accepted. Ordinary HTTPS connections are not universally bypassed. The fullwidth-digit flaw affects Node 24/26; the other two affect 22/24/26.\n\nFixed by the Node release baselines above. [Node security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)\n\n## 3. A DNS lookup can resolve a different name than the application expects\n\n**CVE-2026-105482 \u2014 Node.js**\n\nA NUL character can truncate a hostname during DNS resolution. If application validation and resolution interpret the input differently, attacker-controlled names can undermine destination checks. Reachability depends on whether such input reaches DNS lookup.\n\nFixed by the Node security releases. [Node security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)\n\n## 4. Compromised certificate-authority keys enable convincing impersonation\n\n**eMudhra / emSign incident \u2014 RUSTSEC-2026-0381 and related certificate-distrust updates**\n\nCertificate authorities act as trusted identity issuers for HTTPS. Private keys for affected emSign intermediate authorities became known. An attacker holding one can produce certificates that an unpatched client may accept as legitimate.\n\nA certificate alone does not redirect traffic. The attacker also needs the victim's connection to reach an impersonating server, for example through network interception or DNS manipulation. If both conditions hold, the attacker may read requests and forge responses while the connection appears to use valid TLS.\n\nA hypothetical service impact is stolen API credentials or manipulated responses from an impersonated API. This is an attack scenario, not a finding of actual interception.\n\nTwo fixes address different layers:\n\n- **rustls-webpki 0.103.16** rejects certificate paths containing the distrusted intermediate public keys.\n- **webpki-roots 1.0.10** removes the affected root from its bundled certificate store.\n\nApplications using OS certificate stores need distributor trust updates. Applications embedding certificates or verifiers need rebuilt binaries; updating the host alone does not replace embedded data.\n\nSources: [RustSec advisory](https://raw.githubusercontent.com/RustSec/advisory-db/main/crates/webpki-roots/RUSTSEC-2026-0381.md), [Rustls verifier release](https://github.com/rustls/webpki/releases/tag/v/0.103.16).\n\n## 5. Rustls accepts a malformed transition into encrypted handshake messages\n\n**GHSA-2mjx-qc3c-rqvc \u2014 Rustls**\n\nTLS handshakes transition from plaintext messages to encrypted ones. Vulnerable Rustls accepts certain messages at the wrong encryption level when they share a record with a message that changes the encryption keys. A malicious peer can construct this invalid sequence instead of following the required boundary.\n\nThe limitation matters: **the handshake transcript remains authenticated**. The advisory says a network-position attacker cannot use this flaw to alter or complete a handshake. It is a protocol-validation weakness, not demonstrated arbitrary server impersonation or remote code execution.\n\nAffected: **0.23.13\u20130.23.44**. Fixed: **0.23.45**. [Upstream advisory](https://github.com/advisories/GHSA-2mjx-qc3c-rqvc)\n\n## 6. An HTTP connection can accept a response sent too early\n\n**CVE-2026-105481 \u2014 Node.js**\n\nA keep-alive connection can process response data sent before the corresponding request. Conceptually, a malicious peer can exploit incorrect request/response sequencing to make an application consume an unsolicited response. Whether that changes an application's decisions depends on its connection reuse and response handling.\n\nFixed in the October Node updates. [Node security advisory](https://nodejs.org/en/blog/vulnerability/october-2026-security-releases)\n\n## 7. Startup snapshots can duplicate cached random values\n\n**CVE-2026-106074 \u2014 Node.js**\n\nNode caches randomness used by randomUUID() and randomInt(). Capturing those caches in a startup snapshot or single-executable application can make processes started from the snapshot repeat values. An application relying on uniqueness or unpredictability could then behave unsafely; this does not mean all Node random-number generation is broken.\n\nThe patch resets the caches across snapshots. [Node release details](https://github.com/nodejs/node/releases/tag/v22.23.4)\n\n## 8. A filesystem operation can bypass Node's permission model\n\n**CVE-2026-106073 \u2014 Node.js**\n\nThe realpathSync() operation did not correctly enforce Node's permission model. Code already running inside a process constrained by that model could perform an operation the model should deny. This requires the permission-model scenario; it is not, by itself, a remotely accessible code-execution vulnerability.\n\nThe patch adds the permission check. [Node release details](https://github.com/nodejs/node/releases/tag/v22.23.4)\n\n## What remediation establishes\n\nA runtime or dependency upgrade removes the relevant vulnerable implementation after the rebuilt artifact is deployed. Merging a patch does not update already-running processes. Certificate remediation must cover each actual trust store, including embedded bundles and OS stores.\n\nThis explainer covers the Node 22/24 and Rust TLS fixes. It does not claim remediation of the separate PHP, LiteLLM, Next.js, TiDB, Plex, BeyondTrust, or Ivanti incidents, or of Bun's certificate store.\n", "url": "https://gist.github.com/mrice32/2a38780a81509efbbb58dfb5ebaa34c2"}, {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "vulnerabilities.6.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-22T22:00:00Z", "date_only": false, "value": "2026-10-22T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-23T16:15:05.783Z", "date_only": false, "value": "2026-10-23T16:15:05.783Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-106072", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T16:15:05.783Z", "date_only": false, "value": "2026-10-23T16:15:05.783Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-106072", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-23T16:15:05.783Z", "date_only": false, "value": "2026-10-23T16:15:05.783Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / hackerone", "record": "CVE-2026-106072", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-23T16:25:08.133Z", "date_only": false, "value": "2026-10-23T16:25:08.133855Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117491152154106035", "record": "CVE-2026-106072", "field": "creation_timestamp", "uuid": "3e865b2b-5df7-455d-a9e2-3d8e0c30309d", "content": "CVE-2026-106072  A flaw in Node.js TLS hostname verification allows a certificate with only a DNS SAN to authenticate an IP endpoint when the client connects using a non-canonical IPv4 spelling, such as `0177.0.0.1`, `0x7f.0.0.1`, `2130706433` or `127.1`.\n`tls.checkServerIdentity()` did not classify these hosts as IP addresses, but normalized them to their canonical form and matched the result against the certificate DNS names. A certificate containing `DNS:127.0.0.1` and no `IP Address:127.0.0.1` SAN was therefore accepted, while the same certificate is correctly rejected for `127.0.0.1`. Exploitation requires a certificate with a numeric DNS SAN issued by a CA trusted by the client, and a platform resolver that accepts these spellings, such as glibc.\nThis vulnerability affects Node.js **26.x**, **24.x**, and **22.x**.\nhttps://www.cve.org/CVERecord?id=CVE-2026-106072https://nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs #node#CVE_2026_106072#bot", "url": "https://infosec.exchange/users/cve/statuses/117491152154106035"}, {"timestamp": "2026-10-23T17:17:00Z", "date_only": false, "value": "2026-10-23T17:17:00Z", "kind": "milestone", "label": "Published", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106072", "record": "UBUNTU-CVE-2026-106072", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T17:17:20Z", "date_only": false, "value": "2026-10-23T17:17:20Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-PGHH-9966-75R7", "record": "GHSA-PGHH-9966-75R7", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-23T17:17:20.203Z", "date_only": false, "value": "2026-10-23T17:17:20.203", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106072", "record": "FKIE_CVE-2026-106072", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T18:31:39Z", "date_only": false, "value": "2026-10-23T18:31:39Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-PGHH-9966-75R7", "record": "GHSA-PGHH-9966-75R7", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-23T18:31:39Z", "date_only": false, "value": "2026-10-23T18:31:39Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-PGHH-9966-75R7", "record": "GHSA-PGHH-9966-75R7", "field": "modified"}, {"timestamp": "2026-10-23T19:42:24.553Z", "date_only": false, "value": "2026-10-23T19:42:24.553", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-106072", "record": "FKIE_CVE-2026-106072", "field": "lastModified"}, {"timestamp": "2026-10-24T15:11:03.081Z", "date_only": false, "value": "2026-10-24T15:11:03.081111Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/vuldb/statuses/117496523165009769", "record": "CVE-2026-106072", "field": "creation_timestamp", "uuid": "c5a56895-caa4-4438-aba2-ad1d10c5df98", "content": "\ud83d\udea8 Attention, elevated activities detected targeting Node.js (CVE-2026-106072) https://vuldb.com/vuln/425998/cti", "url": "https://infosec.exchange/users/vuldb/statuses/117496523165009769"}, {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "milestone", "label": "Published", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-25T14:42:02Z", "date_only": false, "value": "2026-10-25T14:42:02Z", "kind": "other", "label": "Updated", "source": "cleanstart \u00b7 CLEANSTART-2026-DV46349", "record": "CLEANSTART-2026-DV46349", "field": "modified"}, {"timestamp": "2026-10-25T23:00:00Z", "date_only": false, "value": "2026-10-25T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-26T14:50:21Z", "date_only": false, "value": "2026-10-26T14:50:21.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-26T23:00:00Z", "date_only": false, "value": "2026-10-26T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.3.date"}, {"timestamp": "2026-10-27T23:00:00Z", "date_only": false, "value": "2026-10-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.4.date"}, {"timestamp": "2026-10-28T01:45:31Z", "date_only": false, "value": "2026-10-28T01:45:31.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.revision_history.2.date"}, {"timestamp": "2026-10-28T01:45:31Z", "date_only": false, "value": "2026-10-28T01:45:31.000Z", "kind": "other", "label": "Updated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-28T07:02:50.893Z", "date_only": false, "value": "2026-10-28T07:02:50.893Z", "kind": "other", "label": "Document generated", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T17:50:30Z", "date_only": false, "value": "2026-10-28T17:50:30Z", "kind": "other", "label": "Updated", "source": "osv_ubuntu \u00b7 UBUNTU-CVE-2026-106072", "record": "UBUNTU-CVE-2026-106072", "field": "modified"}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.revision_history.5.date"}, {"timestamp": "2026-10-28T23:00:00Z", "date_only": false, "value": "2026-10-28T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Document generated", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "other", "label": "Impact", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "vulnerabilities.0.threats.0.date"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "milestone", "label": "Published", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:92376", "record": "ALSA-2026:92376", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T00:00:00Z", "date_only": false, "value": "2026-10-29T00:00:00Z", "kind": "milestone", "label": "Published", "source": "osv_almalinux \u00b7 ALSA-2026:92378", "record": "ALSA-2026:92378", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T08:56:00.617Z", "date_only": false, "value": "2026-10-29T08:56:00.617Z", "kind": "milestone", "label": "Published", "source": "bitnami_vulndb \u00b7 BIT-NODE-2026-106072", "record": "BIT-NODE-2026-106072", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-29T09:16:42.832Z", "date_only": false, "value": "2026-10-29T09:16:42.832Z", "kind": "other", "label": "Updated", "source": "bitnami_vulndb \u00b7 BIT-NODE-2026-106072", "record": "BIT-NODE-2026-106072", "field": "modified"}, {"timestamp": "2026-10-29T09:49:29.885Z", "date_only": false, "value": "2026-10-29T09:49:29.885+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-29T21:38:30Z", "date_only": false, "value": "2026-10-29T21:38:30Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:92376", "record": "ALSA-2026:92376", "field": "modified"}, {"timestamp": "2026-10-29T21:40:47Z", "date_only": false, "value": "2026-10-29T21:40:47Z", "kind": "other", "label": "Updated", "source": "osv_almalinux \u00b7 ALSA-2026:92378", "record": "ALSA-2026:92378", "field": "modified"}, {"timestamp": "2026-10-30T00:01:28.043Z", "date_only": false, "value": "2026-10-30T00:01:28.043412Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:92376", "record": "RLSA-2026:92376", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T09:27:53.918Z", "date_only": false, "value": "2026-10-30T09:27:53.918677Z", "kind": "milestone", "label": "Published", "source": "cleanstart \u00b7 CLEANSTART-2026-DV46349", "record": "CLEANSTART-2026-DV46349", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-30T12:04:27.805Z", "date_only": false, "value": "2026-10-30T12:04:27.805649Z", "kind": "milestone", "label": "Published", "source": "osv_rocky \u00b7 RLSA-2026:92378", "record": "RLSA-2026:92378", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-31T17:13:23Z", "date_only": false, "value": "2026-10-31T17:13:23Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-31T17:13:23Z", "date_only": false, "value": "2026-10-31T17:13:23Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 RHSA-2026:92376", "record": "RHSA-2026:92376", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-31T17:13:24Z", "date_only": false, "value": "2026-10-31T17:13:24Z", "kind": "other", "label": "Advisory revision", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-31T17:13:24Z", "date_only": false, "value": "2026-10-31T17:13:24Z", "kind": "other", "label": "Updated", "source": "csaf_opensuse \u00b7 RHSA-2026:92378", "record": "RHSA-2026:92378", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-11-01T00:12:17.080Z", "date_only": false, "value": "2026-11-01T00:12:17.080876Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:92376", "record": "RLSA-2026:92376", "field": "modified"}, {"timestamp": "2026-11-01T00:12:26.133Z", "date_only": false, "value": "2026-11-01T00:12:26.133252Z", "kind": "other", "label": "Updated", "source": "osv_rocky \u00b7 RLSA-2026:92378", "record": "RLSA-2026:92378", "field": "modified"}], "metrics": {"as_of": "2026-11-01T04:15:41.682Z", "anchors": {"origin": {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start"]}, "total_time_to_patch": {"available": false, "missing": ["start"]}, "disclosure_to_patch": {"available": true, "seconds": 270122.0, "hours": 75.0338888888889, "days": 3.126412037037037, "min_seconds": 270122.0, "max_seconds": 270122.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "time_unpatched": {"available": true, "seconds": 270122.0, "hours": 75.0338888888889, "days": 3.126412037037037, "min_seconds": 270122.0, "max_seconds": 270122.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-21T22:00:00Z", "date_only": false, "value": "2026-10-21T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-4117", "record": "WID-SEC-W-2026-4117", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-25T01:02:02Z", "date_only": false, "value": "2026-10-25T01:02:02.000Z", "kind": "other", "label": "Vendor fix", "source": "csaf_microsoft \u00b7 MSRC_CVE-2026-106072", "record": "MSRC_CVE-2026-106072", "field": "vulnerabilities.0.remediations.0.date", "metric_role": "patch", "metric_basis": "recorded_event"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}