.openvex.json

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://github.com/NVIDIA/aicr/.openvex.json",
  "author": "NVIDIA AICR maintainers",
  "role": "document creator",
  "timestamp": "2026-07-13T00:00:00Z",
  "version": 7,
  "tooling": "manual; aiperf-bench statements verified against aiperf v0.7.0 source; aicr statement reachability verified by source inspection (CGO-free ko build, no libssl linkage); aicr-gate statements suppress CVEs in the embedded upstream kyverno/chainsaw binary (affected packages identified via vuln.go.dev), justified by chainsaw's ephemeral cluster-internal readiness-gate usage",
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-6100",
        "description": "cpython use-after-free in lzma.LZMADecompressor / bz2.BZ2Decompressor / gzip.GzipFile when a decompressor instance is reused after a MemoryError (CWE-416, Critical)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "aiperf v0.7.0 source contains zero imports or references to the gzip, lzma, or bz2 stdlib modules (verified with `grep -rn -E '^(import|from) (gzip|lzma|bz2)'`). The vulnerable decompressor classes are never instantiated. The vulnerability requires not just calling these classes but also reusing the same instance after a MemoryError; one-shot helpers (lzma.decompress(), bz2.decompress(), gzip.decompress(), zlib.decompress()) are not affected per the upstream Python advisory."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-3298",
        "description": "cpython out-of-bounds write in asyncio.ProactorEventLoop.sock_recvfrom_into() on Windows (CWE-787, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The vulnerable class is asyncio.ProactorEventLoop, defined in asyncio.windows_events and conditionally compiled out of non-Windows CPython builds. The aiperf-bench image is based on python:3.13-slim (Debian trixie, Linux/glibc); the ProactorEventLoop class is not present in the shipped CPython binary."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-4786",
        "description": "cpython command injection in webbrowser.open() via crafted URL (CWE-77, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "aiperf imports webbrowser exclusively in aiperf/plot/dashboard/server.py and invokes webbrowser.open(url) only when launching the local plot dashboard server. That code path is reached from the `aiperf plot` subcommand. The aiperf-bench image's benchmark workload runs `aiperf profile` (validators/performance/inference_perf_constraint.go), which never imports the plot or dashboard modules. Additionally, the URL passed to webbrowser.open is the internally-constructed dashboard server URL, not attacker-supplied."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-5450",
        "description": "glibc heap overflow in _vfscanf_internal via the %mc scanf format specifier (CWE-787, Critical)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Trigger requires calling glibc's scanf family with the %mc (malloc'd character match) format specifier. CPython does not expose the C scanf family to Python code. aiperf's declared runtime dependencies (aiohttp, cyclopts, fastapi, jinja2, jmespath, kaleido, matplotlib, msgspec, numpy, pillow, transformers, uvicorn, uvloop, zstandard) parse user input via Python-native parsers, not scanf. Upstream advisory notes %mc is not used by major Linux distros."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-4437",
        "description": "glibc out-of-bounds read in gethostbyaddr / gethostbyaddr_r legacy POSIX reverse DNS lookup (CWE-125, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Upstream advisory explicitly states getaddrinfo() is not affected. aiperf's HTTP client is aiohttp, which uses asyncio's resolver (getaddrinfo) for name resolution; aiperf source contains no gethostbyaddr references. The legacy gethostbyaddr() and gethostbyaddr_r() reverse-DNS functions are not on aiperf-bench's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-4046",
        "description": "glibc iconv() assertion failure DoS when converting IBM1390 / IBM1399 EBCDIC variant character sets (CWE-617, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Trigger requires iconv() conversion specifically to/from IBM1390 or IBM1399. aiperf transports UTF-8 JSON over HTTP between the benchmark and the inference endpoint; Python's defaults are UTF-8 throughout. No code in aiperf or its declared dependencies references IBM1390/IBM1399, codepage 1390, or codepage 1399."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-5435",
        "description": "glibc out-of-bounds write in the deprecated DNS resolver-printing functions ns_printrrf / ns_printrr / fp_nquery when processing TSIG records (CWE-787, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable functions are deprecated libresolv internals (ns_printrrf, ns_printrr, fp_nquery) used for formatting DNS records as text. CPython does not expose these symbols; aiperf and its declared dependencies do not link libresolv or print DNS packets. The benchmark performs only outbound HTTP and name resolution via getaddrinfo."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-5928",
        "description": "glibc buffer under-read in ungetwc / _IO_wdefault_pbackfail on wide-char streams using non-Unicode encodings with byte/multibyte overlaps (CWE-127, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Upstream advisory: the spurious-match condition that triggers the under-read 'is not possible in the standard Unicode character sets.' aiperf runs with Python's default UTF-8 locale; no LC_ALL / LANG override pins the process to a non-Unicode wide-char encoding. The trigger condition cannot occur."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-4878",
        "description": "libcap TOCTOU race in cap_set_file() allowing local privilege escalation when an attacker controls the target's parent directory (CWE-367, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench image drops root after pip install and runs as the non-root user `aiperf` (uid 10001, no shell, no home write privileges; see validators/performance/aiperf-bench.Dockerfile). The workload never calls cap_set_file or any other libcap API; libcap2 is present only as a transitive dependency of base-image utilities. The benchmark process has no capabilities to set and no parent-directory-control vector."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-69720",
        "description": "ncurses stack-based buffer overflow in analyze_string() in progs/infocmp.c, triggered by `infocmp -i` on crafted terminfo input (CWE-121, High)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The vulnerable analyze_string() function lives in the infocmp utility binary (ncurses-bin package), not in the shared libraries (libncursesw6, libtinfo6). Trigger requires executing `infocmp -i <crafted-terminfo>`. The aiperf-bench image runs `aiperf profile` and never invokes infocmp; no shell wrapper or aiperf subcommand exec's it."
    },
    {
      "vulnerability": {
        "name": "GHSA-whj4-6x5x-4v2j",
        "description": "pillow FITS image format decoder GZIP decompression bomb leading to unbounded memory consumption (CVE-2026-40192, CWE-400, High). Fixed in pillow 12.2.0; pinned by aiperf to 12.1.x."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "AICR invokes aiperf-bench as `aiperf profile <text-LLM> --url <endpoint>` against text-only models (Qwen/Qwen3-0.6B per validators/performance/inference_perf_constraint.go) with synthetic text tokens (aiperfInputTokensMean=128, aiperfOutputTokensMean=128). The benchmark transports only JSON over HTTP and never loads image files. aiperf's image-loading code paths in dataset_manager.py / generator/image.py / utils.py are gated to multimodal benchmark configurations that the AICR validator does not exercise. Even when image mode is enabled, aiperf's ImageFormat enum (aiperf/common/enums/enums.py) restricts inputs to PNG/JPEG; FITS is not in the allowlist."
    },
    {
      "vulnerability": {
        "name": "GHSA-pwv6-vv43-88gr",
        "description": "pillow PSD image codec integer overflow leading to out-of-bounds write in src/decode.c / src/encode.c (CVE-2026-25990, CWE-787, High). Fixed in pillow 12.2.0; pinned by aiperf to 12.1.x."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Same reachability argument as GHSA-whj4-6x5x-4v2j: the AICR text-LLM benchmark workload never enters pillow's image-loading paths, and aiperf's ImageFormat allowlist restricts inputs to PNG/JPEG. PSD is not in the allowlist."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-7210",
        "description": "cpython xml.parsers.expat and xml.etree.ElementTree use insufficient entropy for Expat hash-flooding protection, allowing a crafted XML document to trigger hash flooding (GHSA-wxv8-w48j-r2f4, CWE-331, Critical CVSS 9.8). Fix requires libexpat 2.8.0+ AND a CPython patch; as of 2026-06-06 the patch is merged only to cpython main/3.15 \u2014 no 3.13.x backport exists (cpython PR #149646 for 3.14 still open, no 3.13 PR filed)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The attack requires parsing a crafted (attacker-controlled) XML document through xml.parsers.expat or xml.etree.ElementTree to trigger hash flooding. AICR invokes aiperf-bench exclusively as `aiperf profile <text-LLM> --url <endpoint>` (validators/performance/inference_perf_constraint.go). That subcommand communicates with the inference endpoint via JSON over HTTP only; all data transport uses aiohttp + orjson/msgspec. aiperf v0.7.0's declared dependencies contain no XML parsing libraries \u2014 the runtime stack (aiohttp, msgspec, orjson, numpy, transformers, uvicorn, fastapi) is entirely JSON/binary-based. While xml.parsers.expat is present in the Python 3.13 stdlib image, no attacker-controlled XML document can enter the aiperf profile execution path, making the hash-flooding trigger unreachable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-15308",
        "description": "cpython CPU-exhaustion DoS in html.parser.HTMLParser incremental feed() via repeated unterminated markup declarations (PSF-2026-33, CWE-407, High CVSS 7.5/8.7). Fix merged to the cpython 3.13 branch on 2026-07-04 (PR #153040) but as of 2026-07-13 no released CPython contains it — v3.13.14 (2026-06-10), v3.14.6, and v3.15.0b3 all predate the fix, so no base-image bump can remediate yet."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The trigger requires incrementally feeding attacker-controlled HTML containing repeated unterminated markup declarations into html.parser.HTMLParser.feed(). aiperf v0.7.0 source contains zero references to html.parser, HTMLParser, or any html stdlib import (verified with `grep -rn -E 'html\\.parser|HTMLParser|^(import|from) html'` against the PyPI sdist — no hits). AICR invokes aiperf-bench exclusively as `aiperf profile <text-LLM> --url <endpoint>` (validators/performance/inference_perf_constraint.go); the workload exchanges only JSON over HTTP via aiohttp + msgspec/orjson and never parses HTML documents from the inference endpoint or any other source. No attacker-controlled markup can reach the vulnerable parser, so the quadratic-complexity code path is unreachable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45447",
        "description": "OpenSSL heap use-after-free in PKCS7_verify() (CWE-416, High). Fixed for Ubuntu 24.04 (noble) in openssl 3.0.13-0ubuntu3.11; the aicr image inherits the unpatched package transitively from the nvcr.io/nvidia/cuda CUDA base until that base rebuilds."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr",
          "identifiers": {
            "purl": "pkg:oci/aicr"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr image is a statically-linked Go binary built by ko (`ko build ./cmd/aicr --bare`, base from .ko.yaml: nvcr.io/nvidia/cuda:13.2.1-runtime-ubuntu24.04). The build is CGO-free (ko default CGO_ENABLED=0; no `import \"C\"` anywhere in cmd/ or pkg/), so the binary uses Go's native crypto/tls and crypto/x509 and does not dynamically link, dlopen, or otherwise call into libssl3t64/libcrypto. The vulnerable symbol PKCS7_verify is reachable only through the OpenSSL C API, which no process in the container invokes: the openssl and libssl3t64 packages are inert Ubuntu base-image artifacts inherited from the CUDA image, and the container's sole entrypoint is the aicr binary. CVE-2026-45447 requires calling PKCS7_verify on attacker-influenced PKCS#7 input, and that code path does not exist in the running workload. The sibling aicrd image is unaffected by this CVE because it builds on gcr.io/distroless/static:nonroot, which carries no openssl package. Verified with grype v0.110.0 (the scan-action pin) `--vex .openvex.json` against the published ghcr.io/nvidia/aicr scan image: CVE-2026-45447 moves to ignoredMatches for both openssl and libssl3t64 under the vex namespace, leaving zero surviving HIGH findings."
    },
    {
      "vulnerability": {
        "name": "GHSA-jppx-rxg9-jmrx",
        "description": "chainsaw (embedded kyverno binary): key constraints not enforced in golang.org/x/crypto/ssh/agent (CVE-2026-39833, GO-2026-5005)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5005",
        "description": "chainsaw (embedded kyverno binary): key constraints not enforced in golang.org/x/crypto/ssh/agent (CVE-2026-39833, GO-2026-5005)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-f5wc-c3c7-36mc",
        "description": "chainsaw (embedded kyverno binary): agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (CVE-2026-39832, GO-2026-5006)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5006",
        "description": "chainsaw (embedded kyverno binary): agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (CVE-2026-39832, GO-2026-5006)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-q4h4-gmj2-qvw2",
        "description": "chainsaw (embedded kyverno binary): byte arithmetic underflow and panic in golang.org/x/crypto/ssh (CVE-2026-46597, GO-2026-5013)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5013",
        "description": "chainsaw (embedded kyverno binary): byte arithmetic underflow and panic in golang.org/x/crypto/ssh (CVE-2026-46597, GO-2026-5013)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-vgwf-h737-ff37",
        "description": "chainsaw (embedded kyverno binary): client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (CVE-2026-39830, GO-2026-5017)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5017",
        "description": "chainsaw (embedded kyverno binary): client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (CVE-2026-39830, GO-2026-5017)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-w879-237q-wc7r",
        "description": "chainsaw (embedded kyverno binary): pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (CVE-2026-39829, GO-2026-5018)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5018",
        "description": "chainsaw (embedded kyverno binary): pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (CVE-2026-39829, GO-2026-5018)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-89gr-r52h-f8rx",
        "description": "chainsaw (embedded kyverno binary): bypass of FIDO/U2F security key physical interaction in golang.org/x/crypto/ssh (CVE-2026-39831, GO-2026-5019)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5019",
        "description": "chainsaw (embedded kyverno binary): bypass of FIDO/U2F security key physical interaction in golang.org/x/crypto/ssh (CVE-2026-39831, GO-2026-5019)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-rm3j-f69w-wqmq",
        "description": "chainsaw (embedded kyverno binary): infinite loop on large channel writes in golang.org/x/crypto/ssh (CVE-2026-39834, GO-2026-5020)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5020",
        "description": "chainsaw (embedded kyverno binary): infinite loop on large channel writes in golang.org/x/crypto/ssh (CVE-2026-39834, GO-2026-5020)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-5cgq-3rg8-m6cv",
        "description": "chainsaw (embedded kyverno binary): auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (CVE-2026-42508, GO-2026-5021)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5021",
        "description": "chainsaw (embedded kyverno binary): auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (CVE-2026-42508, GO-2026-5021)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GHSA-x527-x647-q7gg",
        "description": "chainsaw (embedded kyverno binary): VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (CVE-2026-46595, GO-2026-5023)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5023",
        "description": "chainsaw (embedded kyverno binary): VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (CVE-2026-46595, GO-2026-5023)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw is a Kubernetes test runner and never establishes SSH client, server, or agent connections; the golang.org/x/crypto/ssh* code path is not reached during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-25679",
        "description": "chainsaw (embedded kyverno binary): incorrect parsing of IPv6 host literals in net/url."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4601",
        "description": "chainsaw (embedded kyverno binary): incorrect parsing of IPv6 host literals in net/url."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27137",
        "description": "chainsaw (embedded kyverno binary): incorrect enforcement of email constraints in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4599",
        "description": "chainsaw (embedded kyverno binary): incorrect enforcement of email constraints in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32280",
        "description": "chainsaw (embedded kyverno binary): unexpected work during chain building in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4947",
        "description": "chainsaw (embedded kyverno binary): unexpected work during chain building in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32281",
        "description": "chainsaw (embedded kyverno binary): inefficient policy validation in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4946",
        "description": "chainsaw (embedded kyverno binary): inefficient policy validation in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32283",
        "description": "chainsaw (embedded kyverno binary): unauthenticated TLS 1.3 KeyUpdate record can cause connection retention and DoS in crypto/tls."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4870",
        "description": "chainsaw (embedded kyverno binary): unauthenticated TLS 1.3 KeyUpdate record can cause connection retention and DoS in crypto/tls."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-33810",
        "description": "chainsaw (embedded kyverno binary): case-sensitive excludedSubtrees name constraints cause auth bypass in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4866",
        "description": "chainsaw (embedded kyverno binary): case-sensitive excludedSubtrees name constraints cause auth bypass in crypto/x509."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The only TLS peer chainsaw connects to is the Kubernetes API server, whose certificate chain is trusted via the in-cluster kubeconfig CA. Triggering this requires an attacker-controlled certificate or TLS peer, which is not present on the gate's execution path."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-33811",
        "description": "chainsaw (embedded kyverno binary): crash when handling long CNAME response in net."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4981",
        "description": "chainsaw (embedded kyverno binary): crash when handling long CNAME response in net."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-33814",
        "description": "chainsaw (embedded kyverno binary): infinite loop in HTTP/2 transport given bad SETTINGS_MAX_FRAME_SIZE (net/http, golang.org/x/net/http2)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw acts only as an HTTP/2 client of the trusted in-cluster API server; triggering this requires a hostile server or hostname, which the gate's usage does not present."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4918",
        "description": "chainsaw (embedded kyverno binary): infinite loop in HTTP/2 transport given bad SETTINGS_MAX_FRAME_SIZE (net/http, golang.org/x/net/http2)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw acts only as an HTTP/2 client of the trusted in-cluster API server; triggering this requires a hostile server or hostname, which the gate's usage does not present."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-39820",
        "description": "chainsaw (embedded kyverno binary): quadratic string concatenation in consumeComment in net/mail."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4986",
        "description": "chainsaw (embedded kyverno binary): quadratic string concatenation in consumeComment in net/mail."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-39836",
        "description": "chainsaw (embedded kyverno binary): panic in Dial and LookupPort on NUL byte (Windows-only) in net."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4971",
        "description": "chainsaw (embedded kyverno binary): panic in Dial and LookupPort on NUL byte (Windows-only) in net."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42499",
        "description": "chainsaw (embedded kyverno binary): quadratic string concatenation in consumePhrase in net/mail."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4977",
        "description": "chainsaw (embedded kyverno binary): quadratic string concatenation in consumePhrase in net/mail."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42504",
        "description": "chainsaw (embedded kyverno binary): quadratic complexity in WordDecoder.DecodeHeader in mime."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5038",
        "description": "chainsaw (embedded kyverno binary): quadratic complexity in WordDecoder.DecodeHeader in mime."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. Triggering this requires attacker-controlled input to the affected parser; chainsaw parses only operator-authored recipe manifests and trusted API-server responses, so the adversarial-input path is not reached."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27140",
        "description": "chainsaw (embedded kyverno binary): code execution in SWIG code generation in cmd/go."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. This vulnerability is in the Go build toolchain (cmd/compile / cmd/go), not in any package linked into the runtime binary. The cmd/* packages are not present in the shipped chainsaw executable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27143",
        "description": "chainsaw (embedded kyverno binary): missing bound checks can lead to memory corruption in cmd/compile."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. This vulnerability is in the Go build toolchain (cmd/compile / cmd/go), not in any package linked into the runtime binary. The cmd/* packages are not present in the shipped chainsaw executable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27144",
        "description": "chainsaw (embedded kyverno binary): miscompilation allows memory corruption via CONVNOP-wrapped array copy in cmd/compile."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. This vulnerability is in the Go build toolchain (cmd/compile / cmd/go), not in any package linked into the runtime binary. The cmd/* packages are not present in the shipped chainsaw executable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-42501",
        "description": "chainsaw (embedded kyverno binary): malicious module proxy can bypass the checksum database in cmd/go."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. This vulnerability is in the Go build toolchain (cmd/compile / cmd/go), not in any package linked into the runtime binary. The cmd/* packages are not present in the shipped chainsaw executable."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5026",
        "description": "chainsaw (embedded kyverno binary): failure to reject ASCII-only Punycode-encoded labels in golang.org/x/net/idna (CVE-2026-39821)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain and older golang.org/x/{crypto,net}; kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. chainsaw acts only as an HTTP/2 client of the trusted in-cluster API server; triggering this requires a hostile server or hostname, which the gate's usage does not present."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5037",
        "description": "chainsaw (embedded kyverno binary): inefficient candidate hostname parsing in crypto/x509 (GO-2026-5037 / CVE-2026-27145)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain (go 1.26.0; crypto/x509 fixed in 1.26.4); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected crypto/x509 candidate-hostname parsing runs only during TLS certificate verification of the in-cluster API server, whose hostname (the operator-configured endpoint) and presented certificate are trusted inputs. An adversary cannot supply the crafted hostname or certificate needed to trigger the inefficient-parsing slowdown, so the code is reachable but its inputs are not attacker-controlled."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-27145",
        "description": "chainsaw (embedded kyverno binary): inefficient candidate hostname parsing in crypto/x509 (GO-2026-5037 / CVE-2026-27145)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) was built with an older Go toolchain (go 1.26.0; crypto/x509 fixed in 1.26.4); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected crypto/x509 candidate-hostname parsing runs only during TLS certificate verification of the in-cluster API server, whose hostname (the operator-configured endpoint) and presented certificate are trusted inputs. An adversary cannot supply the crafted hostname or certificate needed to trigger the inefficient-parsing slowdown, so the code is reachable but its inputs are not attacker-controlled."
    },
    {
      "vulnerability": {
        "name": "GHSA-78mq-xcr3-xm33",
        "description": "chainsaw (embedded kyverno binary): server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (CVE-2026-39835, GO-2026-5015)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) bundles golang.org/x/crypto v0.49.0 (fixed in v0.52.0); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected code path is server-side golang.org/x/crypto/ssh handshake handling (CheckHostKey/Authenticate). chainsaw operates no SSH server and never invokes golang.org/x/crypto/ssh; the panic is reachable only by an SSH server processing a malicious client, which the gate's readiness-check workload does not present."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5015",
        "description": "chainsaw (embedded kyverno binary): server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (CVE-2026-39835, GO-2026-5015)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) bundles golang.org/x/crypto v0.49.0 (fixed in v0.52.0); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected code path is server-side golang.org/x/crypto/ssh handshake handling (CheckHostKey/Authenticate). chainsaw operates no SSH server and never invokes golang.org/x/crypto/ssh; the panic is reachable only by an SSH server processing a malicious client, which the gate's readiness-check workload does not present."
    },
    {
      "vulnerability": {
        "name": "GHSA-45gg-vh54-h5m9",
        "description": "chainsaw (embedded kyverno binary): bypass of certificate restrictions in golang.org/x/crypto/ssh (CVE-2026-39828, GO-2026-5014)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) bundles golang.org/x/crypto v0.49.0 (fixed in v0.52.0); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected code path is golang.org/x/crypto/ssh certificate-restriction enforcement. chainsaw performs no SSH authentication and never invokes golang.org/x/crypto/ssh; with no SSH server or client in the gate's readiness-check workload, the restriction-bypass is not reachable."
    },
    {
      "vulnerability": {
        "name": "GO-2026-5014",
        "description": "chainsaw (embedded kyverno binary): bypass of certificate restrictions in golang.org/x/crypto/ssh (CVE-2026-39828, GO-2026-5014)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary -- the AICR gate binary is clean (built with Go 1.26.5, golang.org/x/crypto v0.53.0, golang.org/x/net v0.56.0). chainsaw v0.2.15 (the latest release) bundles golang.org/x/crypto v0.49.0 (fixed in v0.52.0); kyverno has not yet shipped a rebuilt release. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, talking only to the trusted in-cluster Kubernetes API server. It exposes no network listener, accepts no untrusted ingress, and processes only operator-authored manifests and trusted API-server responses. The affected code path is golang.org/x/crypto/ssh certificate-restriction enforcement. chainsaw performs no SSH authentication and never invokes golang.org/x/crypto/ssh; with no SSH server or client in the gate's readiness-check workload, the restriction-bypass is not reachable."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-39822",
        "description": "chainsaw (embedded kyverno binary): root escape via symlink plus trailing slash in os (CVE-2026-39822, GO-2026-4970)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary, which upstream built with Go 1.26.0 -- the AICR gate binary is clean (built with Go 1.26.5, where this issue is fixed). chainsaw v0.2.15 (the latest release) has not been rebuilt by kyverno with a patched toolchain. The vulnerability is an os.Root escape via a symlink plus trailing slash, requiring the process to open attacker-controlled paths under an os.Root. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, reading only operator-authored test manifests baked into the bundle ConfigMap and trusted in-cluster Kubernetes API-server responses. No attacker-influenced filesystem paths are opened, so the symlink-escape precondition is not reachable during `chainsaw test`."
    },
    {
      "vulnerability": {
        "name": "GO-2026-4970",
        "description": "chainsaw (embedded kyverno binary): root escape via symlink plus trailing slash in os (CVE-2026-39822, GO-2026-4970)."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-gate",
          "identifiers": {
            "purl": "pkg:oci/aicr-gate"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aicr-gate image embeds the upstream, cosign-attested kyverno/chainsaw binary (/usr/local/bin/chainsaw, CHAINSAW_VERSION in .settings.yaml) alongside the AICR gate binary; see cmd/gate/Dockerfile. The vulnerable code is present ONLY in that embedded chainsaw binary, which upstream built with Go 1.26.0 -- the AICR gate binary is clean (built with Go 1.26.5, where this issue is fixed). chainsaw v0.2.15 (the latest release) has not been rebuilt by kyverno with a patched toolchain. The vulnerability is an os.Root escape via a symlink plus trailing slash, requiring the process to open attacker-controlled paths under an os.Root. Within AICR, chainsaw runs exclusively as an ephemeral, cluster-internal readiness-gate Job: the bundler launches it to `chainsaw test` recipe-authored assertions, reading only operator-authored test manifests baked into the bundle ConfigMap and trusted in-cluster Kubernetes API-server responses. No attacker-influenced filesystem paths are opened, so the symlink-escape precondition is not reachable during `chainsaw test`."
    }
  ]
}