{
 "@context": "https://openvex.dev/ns/v0.2.0",
 "@id": "https://fermihdi.io/vex/da0fdc77fc684cc6bd32f87cfeaa5ddf",
 "author": "FermiHDI",
 "role": "Software vendor",
 "timestamp": "2026-09-29T01:07:29Z",
 "version": 1,
 "tooling": "Trivy findings triaged by package reachability",
 "statements": [
  {
   "vulnerability": {
    "name": "CVE-2024-56433"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1"
      },
      {
       "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "login.defs is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker. passwd is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18374"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04"
      },
      {
       "@id": "pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-gconv-modules-extra is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image). libc6 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18477"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18508"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35341"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35344"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35345"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35348"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35350"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35351"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35352"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35354"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35357"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35359"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35360"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35363"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35364"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35367"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35368"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35370"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35371"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35373"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35374"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35377"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-40228"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/libsystemd0@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04"
      },
      {
       "@id": "pkg:deb/ubuntu/libudev1@259.5-0ubuntu3.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libsystemd0 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image). libudev1 is installed with the Ubuntu base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable and bundled library in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-81870"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:generic/go.opentelemetry.io/otel/exporters/otlp/otlptrace@v1.43.0"
      },
      {
       "@id": "pkg:generic/go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp@v1.43.0"
      },
      {
       "@id": "pkg:generic/go.opentelemetry.io/otel/sdk@v1.44.0"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "The configuration leak happens only in OpenTelemetry's internal Info-level diagnostic logging, which an application must enable with otel.SetLogger. The DMS services never call it (no reference in the shipped binaries), so the diagnostic event is never recorded.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-85091"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:generic/zlib1g@1:1.3.dfsg+really1.3.1-1ubuntu3.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "zlib1g is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89092"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89161"
   },
   "products": [
    {
     "@id": "pkg:oci/dms-core@sha256:a8d2cdeff9c5c075b5f5edb26bf8a116e64d2007345090d27e1cd129987d2e93?repository_url=cr.fermihdi.io/hd/dms-core",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  }
 ]
}