{"uuid": "c0f655a8-1201-40e6-b70a-d0ef2e0444fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-rgh6-rfwx-v388", "type": "seen", "source": "https://gist.github.com/cwayne18/2df919c96745d903491c33321eb89359", "content": "cwayne@geeko ~ % /System/Volumes/Data/Users/cwayne/go/bin/vexscan --image docker.io/rancher/rke2-runtime:v1.36.2-rke2r1 --all --severity CRITICAL,HIGH --vexhub https://github.com/rancher/vexhub --gist\nExtracting docker.io/rancher/rke2-runtime:v1.36.2-rke2r1 (linux/amd64)...\nScanning for Go binaries...\nFound 7 Go binaries.\nResolving advisories for 306 components (306 OSV queries)...\nVEX hub https://github.com/rancher/vexhub: 1083 products indexed\nVEX hub https://github.com/rancher/vexhub: 29 finding(s) already covered by a published statement\nvexscan report (image) for docker.io/rancher/rke2-runtime:v1.36.2-rke2r1\nNOTE: --severity CRITICAL,HIGH withheld 125 of 161 findings:\n      99 unknown (no rating was published), 24 medium, 2 low\n\n  golang   Go                        306 components    36 findings\n  affected by severity: 7 high\n  already vexed: 15 by Rancher Security team\n\nAFFECTED (7) - vulnerable code is present and can be loaded\nSEVERITY  ADVISORY      PACKAGE                 VERSION  BASIS\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.80.0\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.80.0\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.80.0\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.80.0\nHIGH      GO-2026-6061  google.golang.org/grpc  v1.79.3\nHIGH      GO-2022-0965  k8s.io/apimachinery     (devel)\nHIGH      GO-2022-0965  k8s.io/apimachinery     (devel)\n\nALREADY VEXED (15) - a published statement answers these; vexscan's own verdict is unchanged\nSEVERITY  ADVISORY             PACKAGE                              VERSION               VEX STATUS    JUSTIFICATION\nCRITICAL  GHSA-cvxm-645q-p574  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nCRITICAL  GHSA-cvxm-645q-p574  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nCRITICAL  GHSA-cvxm-645q-p574  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-33vj-92qq-66hc  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-33vj-92qq-66hc  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-33vj-92qq-66hc  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-rgh6-rfwx-v388  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-rgh6-rfwx-v388  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-rgh6-rfwx-v388  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-xhf5-7wjv-pqxp  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-xhf5-7wjv-pqxp  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-xhf5-7wjv-pqxp  github.com/containerd/containerd/v2  v2.3.2-k3s2           not_affected  vulnerable_code_not_present\nHIGH      GHSA-x744-4wpc-v9h2  github.com/docker/docker             v27.1.1+incompatible  not_affected  vulnerable_code_not_in_execute_path\nHIGH      GO-2026-5426         go.opentelemetry.io/otel/sdk         v1.42.0               not_affected  vulnerable_code_not_in_execute_path\nHIGH      GO-2026-5426         go.opentelemetry.io/otel/sdk         v1.40.0               not_affected  vulnerable_code_not_present\n\nRULED OUT (14) - the vulnerable code is not present or cannot run\nSEVERITY  ADVISORY             PACKAGE                   VERSION               BASIS\nCRITICAL  GO-2026-5005         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5006         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5017         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5019         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5020         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5021         golang.org/x/crypto       v0.47.0               pclntab\nCRITICAL  GO-2026-5023         golang.org/x/crypto       v0.47.0               pclntab\nHIGH      GHSA-x744-4wpc-v9h2  github.com/docker/docker  v27.3.1+incompatible  pclntab-module\nHIGH      GO-2026-5617         github.com/docker/docker  v27.3.1+incompatible  pclntab\nHIGH      GO-2026-5617         github.com/docker/docker  v27.1.1+incompatible  pclntab\nHIGH      GO-2026-5746         github.com/docker/docker  v27.3.1+incompatible  pclntab\nHIGH      GO-2026-5746         github.com/docker/docker  v27.1.1+incompatible  pclntab\nHIGH      GO-2026-5013         golang.org/x/crypto       v0.47.0               pclntab\nHIGH      GO-2026-5018         golang.org/x/crypto       v0.47.0               pclntab", "creation_timestamp": "2026-08-04T15:15:12.911345Z"}