{"id":"DHI-vhh2-i55o-7ijy-dhqe","summary":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For…","details":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".","modified":"2026-11-10T22:15:02.988710292Z","published":"2026-11-10T22:09:25Z","upstream":["CVE-2026-39821"],"references":[{"type":"ADVISORY","url":"https://scout.docker.com/v/DHI-vhh2-i55o-7ijy-dhqe"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821"},{"type":"ADVISORY","url":"https://pkg.go.dev/vuln/GO-2026-5026"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8"},{"type":"WEB","url":"https://go.dev/issue/78760"},{"type":"WEB","url":"https://go.dev/cl/767220"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-30853.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30853"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-30854.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:30854"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-34359.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:34359"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-35828.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35828"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-35829.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35829"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-35830.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35830"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-35831.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:35831"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-37435.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:37435"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-38995.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:38995"},{"type":"ADVISORY","url":"https://errata.almalinux.org/9/ALSA-2026-65153.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:65153"},{"type":"ADVISORY","url":"https://errata.almalinux.org/8/ALSA-2026-66016.html"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:66016"},{"type":"ADVISORY","url":"https://security.alpinelinux.org/vuln/CVE-2026-39821"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2/ALAS-2026-3334.html"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46598"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46597"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-46595"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42506"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42502"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39834"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39833"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39831"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39828"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39827"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25680"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1788.html"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1835.html"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1847.html"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1884.html"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42507"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42504"},{"type":"ADVISORY","url":"http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1885.html"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1886.html"},{"type":"ADVISORY","url":"https://alas.aws.amazon.com/AL2023/ALAS-2026-1902.html"},{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-39821"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-30853.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-30853.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-30854.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-30854.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-30855.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-30855.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35826.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35826.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35827.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35827.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35828.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35828.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35829.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35829.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35830.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35830.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-35831.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-35831.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-37435.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-37435.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-37436.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-37436.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-38995.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-38995.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-39573.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-39573.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-46395.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-46395.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-65153-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-65153-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-65534-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-65534-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-65886-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-65886-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/cve/ELSA-2026-66432-0.html"},{"type":"ADVISORY","url":"https://linux.oracle.com/errata/ELSA-2026-66432-0.html"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:30853"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:30854"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:30855"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:34357"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:34359"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35826"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35827"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35828"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35829"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35830"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:35831"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:37435"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:37436"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:38995"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:39573"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:46395"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:65153"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:65534"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:65886"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:66016"},{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2026:66432"},{"type":"ADVISORY","url":"https://ubuntu.com/security/CVE-2026-39821"},{"type":"ADVISORY","url":"http://people.ubuntu.com/~ubuntu-security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://github.com/golang/go/issues/80476"},{"type":"WEB","url":"https://github.com/golang/go/issues/78760"}],"affected":[{"package":{"name":"tailscale-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json","owner_kind":"HSP"}},{"package":{"name":"tailscale-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-nameserver-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-nameserver-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json","owner_kind":"HSP"}},{"package":{"name":"tailscale-k8s-nameserver-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-nameserver","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-nameserver"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-operator-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-operator-fips-dev","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-fips-dev"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale-k8s-operator-fips","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator-fips"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json","owner_kind":"HSP"}},{"package":{"name":"tailscale-k8s-operator","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale-k8s-operator"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}},{"package":{"name":"tailscale","ecosystem":"Docker Hardened Images:Alpine:3.23","purl":"pkg:apk/dhi/tailscale"},"versions":["1.100.0-r0","1.100.0-r1","1.100.0-r2","1.100.0-r3","1.100.0-r4","1.100.0-r5","1.102.0-r0","1.102.0-r1","1.102.2-r0","1.102.2-r1","1.102.3-r0","1.102.3-r1","1.102.3-r2","1.102.3-r3","1.102.3-r4","1.102.4-r0","1.102.5-r0","1.104.0-r0","1.104.1-r0","1.104.1-r1","1.104.1-r2","1.104.2-r0","1.104.4-r0","1.104.4-r1","1.104.5-r0","1.104.5-r1","1.98.1-r0","1.98.2-r0","1.98.2-r1","1.98.2-r2","1.98.3-r0","1.98.3-r1","1.98.3-r2","1.98.4-r0","1.98.5-r0","1.98.5-r1"],"database_specific":{"owner_kind":"HSP","source":"https://github.com/docker-hardened-images/advisories-test/blob/main/osv/2026/DHI-vhh2-i55o-7ijy-dhqe.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}]}