{"vulnerability": "ghsa-hrxh-6v49-42gf", "sightings": [{"uuid": "c19d48c4-15b3-4124-878b-f4a477572ed9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/mfahlandt.bsky.social/post/3ms6hejb7hx2j", "content": "\ud83d\ude80 LWCN Week 32: Cilium v1.20.0 released.\n- Cilium v1.20.0: Major release.\n- Prometheus v3.13.2: Security updates (CVE-2026-56852, GHSA-hrxh-6v49-42gf) + PromQL bug fix.\n- OPA v1.19.0: SQL injection vulnerability addressed, cgo-free WebAssembly runtime adde\u2026\n\nhttps://lwcn.dev/newsletter/2026-week-32/", "creation_timestamp": "2026-08-03T12:03:59.761753Z"}, {"uuid": "cd17c0d0-4bf1-4ec2-b8dc-101599965b41", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://gist.github.com/allanrogerr/6d10196ab8eb0d80a2cfca871b45d9a8", "content": "## Description\n\nBump the two dependencies flagged by govulncheck's live DB on 2026-07-27 to their fixed versions, across every module that pins a vulnerable release:\n\n- `google.golang.org/grpc` v1.81.1 \u2192 v1.82.1 (root `go.mod`) and v1.80.0 \u2192 v1.82.1 (`test/integration/tables/iceberg-compat-tests/catalog-api-tests`) \u2014 clears GO-2026-6061 (GHSA-hrxh-6v49-42gf, xDS RBAC engine + HTTP/2 transport server).\n- `github.com/klauspost/compress` v1.17.11 / v1.18.0 / v1.18.5 \u2192 v1.18.7 (`docs/debugging/inspect`, `docs/debugging/s3-verify`, `catalog-api-tests`) \u2014 clears GO-2026-5841 (GHSA-259r-337f-4rfw, OOB read in `compress/s2`).\n\nThe bumps were produced by the repo's own tooling (`python3 govulncheck.py --fix`, added in #6246), so the diff is exactly `go get ` + `go mod tidy` in each module: 8 files, all `go.mod`/`go.sum`, 42 insertions / 42 deletions.\n\n**Basic Checks goes back to green on every open PR** \u2014 since ~17:59Z on 2026-07-27 every `Run govulncheck` step in the repo fails on these two advisories.\n\n## Motivation and Context\n\n`govulncheck` (Basic Checks, `Run govulncheck` step) fails on GO-2026-5841 and GO-2026-6061 in every run since the live vulnerability DB began reporting them between 17:20Z and 17:59Z on 2026-07-27. The pinned versions are identical on `edge` (and `master`), so this is not caused by any in-flight branch: PRs #6406, #6323, #6048, and #6535 all hit the same failure on branches that share none of each other's changes, and PR #6535's head SHA `e86c2e3` passed Basic Checks at 17:04Z and failed at 19:20Z with zero code change in between. Fixed releases exist upstream (grpc v1.82.1, compress v1.18.7). This is the same newly-disclosed-CVE pattern previously fixed by #6518 (otel), #6458 (x/net, x/text), and #6230 (quic-go).\n\n**Known gap:** the `.govulncheck-ignore.toml` entry for GO-2026-5662 (`github.com/prometheus/prometheus`) already matches nothing on `edge` \u2014 the wrapper prints a non-fatal \"ignore entries matched nothing\" warning before and after this change. Pruning it is intentionally left out of this diff to keep the bump minimal.\n\n## How to test this PR?\n\n```\npython3 govulncheck.py\n```\n\nReports `govulncheck \u2014 0 vulnerabilities, 4 ignored` and exits 0 (validated locally on this branch; the pre-fix run of the same command reproduces CI's failing `5 vulnerabilities, 4 ignored` table byte-for-byte). `go build ./...` passes in each touched module.\n\n## Types of changes\n\n- [x] Bug fix (non-breaking change which fixes an issue)\n- [ ] New feature (non-breaking change which adds functionality)\n- [ ] Optimization (provides speedup with no functional changes)\n- [ ] Cleanup/Maintenance (no functional changes)\n- [ ] Breaking change (fix or feature that would cause existing functionality to change)\n\n## Checklist:\n\n- [ ] Fixes a regression (If yes, please add `commit-id` or `PR #` here)\n- [ ] Unit tests added/updated\n- [ ] Internal documentation updated\n- [ ] Create a documentation update request [here](https://github.com/miniohq/aistor-object-store-docs/issues/new)\n- [x] No internode changes / version interoperability introduced\n\n## CI Workflow Labels\n\nOn draft PRs, CI is not run unless labels are set. See [selective-CI label\nquick reference](https://github.com/miniohq/aistor/blob/edge/.github/selective-ci.md#ci-labels-quick-reference) for more information.\n", "creation_timestamp": "2026-07-27T19:48:38.410906Z"}, {"uuid": "e5747bf1-dbb0-46f9-889d-e1a1469e2610", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6our2h2v", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-asm-istiod", "creation_timestamp": "2026-09-20T05:20:06.946830Z"}, {"uuid": "66983643-db6b-43db-ab0b-6c5020127aab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p2dlm2s", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-connect-agent", "creation_timestamp": "2026-09-20T05:20:07.935066Z"}, {"uuid": "68702157-1017-4dcb-a8a8-44b49378c660", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p7ulh2c", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security", "creation_timestamp": "2026-09-20T05:20:08.973073Z"}, {"uuid": "f9621d19-1785-4a36-906c-451cd9e4c987", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pl5ah2v", "content": "GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59898 CVE-2026-59899 CVE-2026-59900 CVE-2026-59901 CVE-2026-59903 CVE-2026-59921", "creation_timestamp": "2026-09-20T05:20:11.142415Z"}, {"uuid": "9a25d47a-b9fd-437c-9736-56ff413fa686", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6qjfmk2k", "content": "CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-redis. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 N/A", "creation_timestamp": "2026-09-20T05:20:16.003178Z"}, {"uuid": "0ab5f127-e191-4a1d-817d-77a4d678fc1a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pwczh2b", "content": "CVE-2026-59901 CVE-2026-59903 CVE-2026-59921 CVE-2026-73508 CVE-2026-75595 CVE-2026-75596 N/A Security fixes for apigee-open-telemetry-collector. This addresses the following vulnerability: GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators", "creation_timestamp": "2026-09-20T05:20:13.299763Z"}, {"uuid": "edbbb2b3-67fc-4a73-bbba-3a08fe13cbe8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6q6hc72e", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf GHSA-w67g-5rqw-f597 N/A", "creation_timestamp": "2026-09-20T05:20:14.449617Z"}, {"uuid": "d196043e-8fa1-4b0e-8f08-d05c52c0fcc4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6r7w372b", "content": "CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf Forward proxy support for AI policies Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be", "creation_timestamp": "2026-09-20T05:20:20.148548Z"}, {"uuid": "dd64c783-929e-4718-8a3e-3d945312858c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n3spb22a", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-asm-istiod", "creation_timestamp": "2026-09-25T05:40:08.858206Z"}, {"uuid": "16e83415-233e-40ba-be7f-53f685240868", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n3yhq32h", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-connect-agent", "creation_timestamp": "2026-09-25T05:40:09.499914Z"}, {"uuid": "786049e0-fcd6-4b99-9177-a01a021bbf35", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n46bgi2l", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security", "creation_timestamp": "2026-09-25T05:40:10.294490Z"}, {"uuid": "7aa2ca62-3a44-46d9-883d-b4d58d5fa83c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l", "content": "CVE-2026-81870 CVE-2026-81871 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860", "creation_timestamp": "2026-09-25T05:40:15.075458Z"}, {"uuid": "35c4e5b8-1eda-4177-90de-dccda85a769a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n4pnzc2a", "content": "CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2026-54515 CVE-2026-55831 CVE-2026-55833 CVE-2026-56745 CVE-2026-56746 CVE-2026-56819 CVE-2026-59889 CVE-2026-59898 CVE-2026-59899", "creation_timestamp": "2026-09-25T05:40:12.667442Z"}, {"uuid": "8598ded9-9922-486d-94c1-a53a0ed02ee5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5gt4i2k", "content": "CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf GHSA-w67g-5rqw-f597 N/A Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859", "creation_timestamp": "2026-09-25T05:40:16.198588Z"}, {"uuid": "acb01589-8739-4d1a-99a6-f0f8bc63e56b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5nf3l2h", "content": "CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-prometheus-adapter. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859", "creation_timestamp": "2026-09-25T05:40:16.990477Z"}, {"uuid": "afed1bb0-16b2-4f50-bc89-58cbd296d0c3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-hrxh-6v49-42gf", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5tfgv2c", "content": "CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-redis. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600", "creation_timestamp": "2026-09-25T05:40:17.791297Z"}]}