{"id":"CGA-7xp4-hq95-467g","modified":"2026-07-17T18:44:24.326800861Z","published":"2026-04-03T12:04:04Z","upstream":["CVE-2026-34986","GHSA-78h2-9frx-2jm8","GO-2026-4945"],"references":[{"type":"WEB","url":"https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-34986.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10125"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10130"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:10175"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11070"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11217"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11512"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11688"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11856"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11916"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:11996"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12116"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12277"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:12279"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13791"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:13829"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16696"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17040"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17121"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17123"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17287"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17458"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17459"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17474"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17547"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17550"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17598"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17789"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18584"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:18585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19108"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19135"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19173"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19186"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19353"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19712"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19719"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19720"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19721"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20034"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20569"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20607"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20609"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20946"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21703"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21709"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21769"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21931"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21932"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22258"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22260"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22347"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22423"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22450"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22714"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23228"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23241"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23345"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23361"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24471"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24475"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24477"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24479"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24482"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24484"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24853"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25127"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25187"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25194"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25206"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25248"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25250"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25252"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26054"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26568"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26585"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26636"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27001"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27004"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27044"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27063"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:27856"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:28198"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:29854"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30650"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:32991"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33722"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34192"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34196"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34197"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34364"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35833"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8490"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8491"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:8493"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9385"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9388"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9448"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:9453"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-34986"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34986.json"},{"type":"ADVISORY","url":"https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34986"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2455470"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34794"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34099"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36820"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37387"}],"affected":[{"package":{"name":"crossplane-provider-gcp-kms","ecosystem":"Chainguard","purl":"pkg:apk/chainguard/crossplane-provider-gcp-kms?arch=x86_64"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-r6"}]}],"ecosystem_specific":{"components":[{"latest_event_status":"fixed","latest_event_timestamp":"2026-04-03T21:09:23Z","architecture":"x86_64","component_name":"github.com/go-jose/go-jose/v4","component_version":"v4.1.3","component_type":"go-module","component_location":"/usr/bin/provider-gcp-kms","component_purl":"pkg:golang/github.com/go-jose/go-jose/v4@v4.1.3"}]},"database_specific":{"source":"https://advisories.cgr.dev/chainguard/v3/osv/CGA-7xp4-hq95-467g.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}