{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/v1/"
      }
    },
    "lang": "en",
    "publisher": {
      "category": "vendor",
      "contact_details": "See contact points at https://github.com/gocsaf",
      "name": "gocsaf Development Community",
      "namespace": "https://github.com/gocsaf"
    },
    "references": [
      {
        "category": "self",
        "summary": "gocsaf-2026-001",
        "url": "https://gocsaf.github.io/.well-known/csaf/white/2026/gocsaf-2026-001.json"
      }
    ],
    "title": "gocsaf/csaf: csaf_provider uncontrolled resource consumption vulnerability",
    "tracking": {
      "current_release_date": "2026-10-16T08:00:00Z",
      "id": "gocsaf-2026-001",
      "initial_release_date": "2026-10-16T08:00:00Z",
      "revision_history": [
        {
          "date": "2026-10-16T08:00:00Z",
          "number": "1.0.0",
          "summary": "Initial revision"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "csaf_aggregator all versions",
                      "product_id": "gocsaf-csaf-aggregator"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_aggregator"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "csaf_checker all versions",
                      "product_id": "gocsaf-csaf-checker"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_checker"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "csaf_downloader all versions",
                      "product_id": "gocsaf-csaf-downloader"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_downloader"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:semver/>=0.0.0|<=3.6.0",
                    "product": {
                      "name": "csaf_provider versions 0.0.0 through 3.6.0",
                      "product_id": "gocsaf-csaf-provider-b3.6.0"
                    }
                  },
                  {
                    "category": "product_version",
                    "name": "3.7.0",
                    "product": {
                      "name": "csaf_provider version 3.7.0",
                      "product_id": "gocsaf-csaf-provider-3.7.0"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_provider"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "csaf_uploader all versions",
                      "product_id": "gocsaf-csaf-uploader"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_uploader"
              },
              {
                "branches": [
                  {
                    "category": "product_version_range",
                    "name": "vers:all/*",
                    "product": {
                      "name": "csaf_validator all versions",
                      "product_id": "gocsaf-csaf-validator"
                    }
                  }
                ],
                "category": "product_name",
                "name": "csaf_validator"
              }
            ],
            "category": "product_family",
            "name": "gocsaf/csaf"
          }
        ],
        "category": "vendor",
        "name": "gocsaf Development Community"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-107564",
      "involvements": [
        {
          "date": "2026-09-18T08:25:00.000Z",
          "party": "discoverer",
          "status": "completed",
          "summary": "https://github.com/kta1kri: Discovered the vulnerability and contacted the gocsaf Development Community via email."
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "An unauthenticated remote attacker may exploit an allocation of resources without limits or throttling in csaf_provider to cause high CPU load leading to a denial of service.",
          "title": "Vulnerability description"
        }
      ],
      "product_status": {
        "first_fixed": [
          "gocsaf-csaf-provider-3.7.0"
        ],
        "fixed": [
          "gocsaf-csaf-provider-3.7.0"
        ],
        "known_affected": [
          "gocsaf-csaf-provider-b3.6.0"
        ],
        "known_not_affected": [
          "gocsaf-csaf-aggregator",
          "gocsaf-csaf-checker",
          "gocsaf-csaf-downloader",
          "gocsaf-csaf-uploader",
          "gocsaf-csaf-validator"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-107564",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-107564"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "Update csaf_provider to version 3.7.0 or later. Versions 3.7.0 and later are not affected by this vulnerability.",
          "product_ids": [
            "gocsaf-csaf-provider-b3.6.0"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "gocsaf-csaf-provider-b3.6.0"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the affected product to cause high CPU load leading to a denial of service.",
          "product_ids": [
            "gocsaf-csaf-provider-b3.6.0"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected. The vulnerability was fixed in version 3.7.0.",
          "product_ids": [
            "gocsaf-csaf-provider-3.7.0"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected.",
          "product_ids": [
            "gocsaf-csaf-aggregator"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected",
          "product_ids": [
            "gocsaf-csaf-checker"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected",
          "product_ids": [
            "gocsaf-csaf-downloader"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected",
          "product_ids": [
            "gocsaf-csaf-uploader"
          ]
        },
        {
          "category": "impact",
          "details": "Not affected",
          "product_ids": [
            "gocsaf-csaf-validator"
          ]
        }
      ],
      "title": "gocsaf/csaf: csaf_provider prone to uncontrolled resource consumption"
    }
  ]
}