{
 "@context": "https://openvex.dev/ns/v0.2.0",
 "@id": "https://fermihdi.io/vex/ad9422c3b633467bbffd950e0ad24e62",
 "author": "FermiHDI",
 "role": "Software vendor",
 "timestamp": "2026-09-29T01:07:29Z",
 "version": 1,
 "tooling": "Trivy findings triaged by package reachability",
 "statements": [
  {
   "vulnerability": {
    "name": "CVE-2024-56433"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/login.defs@4.17.4-2ubuntu3?arch=all&distro=ubuntu-26.04&epoch=1"
      },
      {
       "@id": "pkg:deb/ubuntu/passwd@4.17.4-2ubuntu3?arch=amd64&distro=ubuntu-26.04&epoch=1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "login.defs is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker. passwd is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-13757"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/libp11-kit0@0.26.2-2"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libp11-kit0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18374"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18477"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-18508"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/tar@1.35%2Bdfsg-4ubuntu0.4?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "tar is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35341"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35344"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35345"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35348"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35350"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35351"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35352"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35354"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35357"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35359"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35360"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35363"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35364"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35367"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35368"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35370"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35371"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35373"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35374"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-35377"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:deb/ubuntu/rust-coreutils@0.8.0-0ubuntu3?arch=amd64&distro=ubuntu-26.04"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
   "impact_statement": "rust-coreutils is part of the Ubuntu base image. HD's services do not run it on network-supplied or user-supplied input, so the vulnerable code cannot be reached by an attacker.",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-40228"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/libsystemd0@259.5-0ubuntu3.4"
      },
      {
       "@id": "pkg:generic/libudev1@259.5-0ubuntu3.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libsystemd0, libudev1 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-85091"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/zlib1g@1:1.3.dfsg+really1.3.1-1ubuntu3.1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "zlib1g is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89092"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/libc-bin@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc-gconv-modules-extra@2.43-2ubuntu2.4"
      },
      {
       "@id": "pkg:generic/libc6@2.43-2ubuntu2.4"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libc-bin, libc-gconv-modules-extra, libc6 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  },
  {
   "vulnerability": {
    "name": "CVE-2026-89161"
   },
   "products": [
    {
     "@id": "pkg:oci/ipflow_graphql@sha256:f5866942ae6bbeae01c62bc4d656f85d2eb4afd709617156d4607e1577e01c43?repository_url=cr.fermihdi.io/hd/ipflow_graphql",
     "subcomponents": [
      {
       "@id": "pkg:generic/libpcre2-8-0@10.46-1build1"
      }
     ]
    }
   ],
   "status": "not_affected",
   "justification": "vulnerable_code_not_in_execute_path",
   "impact_statement": "libpcre2-8-0 is installed with the base image, but none of its shared objects are loaded by the service's binaries (checked with ldd over every executable in the image).",
   "timestamp": "2026-09-29T01:07:29Z"
  }
 ]
}