Sync Collecting Fix Commits: Tue Jul 28 15:12:36 UTC 2026

Signed-off-by: AboutCode Automation <automation@aboutcode.org>

Author: aboutcode-automation

data/fix-commits/advisory-database-b78f1d41.json

@@ -1,6 +1,52 @@
 {
   "vcs_url": "https://github.com/github/advisory-database",
   "vulnerabilities": {
+    "GHSA-3PWP-G2MJ-5P3V": {
+      "0c595d50d33a410f13158643f09f038263310698": "Publish Advisories\n\nGHSA-3pwp-g2mj-5p3v\nGHSA-4pj9-g833-qx53"
+    },
+    "GHSA-4PJ9-G833-QX53": {
+      "0c595d50d33a410f13158643f09f038263310698": "Publish Advisories\n\nGHSA-3pwp-g2mj-5p3v\nGHSA-4pj9-g833-qx53"
+    },
+    "GHSA-28F5-38XR-JH2W": {
+      "aa2be1ca041031b27e045000e8367ed72d67e71d": "Publish Advisories\n\nGHSA-28f5-38xr-jh2w\nGHSA-hp74-gm6m-2qm5"
+    },
+    "GHSA-HP74-GM6M-2QM5": {
+      "aa2be1ca041031b27e045000e8367ed72d67e71d": "Publish Advisories\n\nGHSA-28f5-38xr-jh2w\nGHSA-hp74-gm6m-2qm5"
+    },
+    "GHSA-W6P7-2FXX-4F44": {
+      "82e612874b3d720e54a986245fec9d23caac5af3": "Publish GHSA-w6p7-2fxx-4f44"
+    },
+    "GHSA-9342-92GG-6V29": {
+      "0e10fec39ff7d042043ae9c88f7c5c3eee6bbf15": "Improve GHSA-9342-92gg-6v29",
+      "074c54ac2e87fdf21d5ed993503e6665ae57d014": "Improve GHSA-9342-92gg-6v29",
+      "6737202d6337c10cfc993aa927a863e726d85c3a": "Publish GHSA-9342-92gg-6v29",
+      "f103ccecc9305b9526f4fd3c273e524f1f7a9593": "Publish Advisories\n\nGHSA-67jc-hmvg-q4c7\nGHSA-72ww-4rcw-mc62\nGHSA-9342-92gg-6v29\nGHSA-cx25-xg7c-xfm5\nGHSA-rrff-chj9-w4c7\nGHSA-jr43-q92q-5q82\nGHSA-p288-459w-jxj6\nGHSA-xg8j-j6vp-6h5w",
+      "706c715bb73e0443b06e5cc0e384c9cbab3260a4": "Publish Advisories\n\nGHSA-9342-92gg-6v29\nGHSA-qj5r-2r5p-phc7\nGHSA-9342-92gg-6v29"
+    },
+    "GHSA-792X-6VQ6-J8R9": {
+      "e7b742ff289fe1ee25d2f4e9c1c5b62cd7192d2b": "Improve GHSA-792x-6vq6-j8r9",
+      "701e5b5e8a62954451259756131507abd002dc67": "Improve GHSA-792x-6vq6-j8r9",
+      "fcdc354056acda71ce0aa768f1a6d67f6d7c2f36": "Publish Advisories\n\nGHSA-792x-6vq6-j8r9\nGHSA-mvq4-39wx-6h5g\nGHSA-6v4j-43gg-vj32\nGHSA-792x-6vq6-j8r9",
+      "c955e2e4d0c901b5ba1f8a62d562523ce1f01fad": "Publish Advisories\n\nGHSA-hq3q-62v8-pp48\nGHSA-2mpf-m756-hxjm\nGHSA-5vq9-cj6j-3h3r\nGHSA-5x25-c2rf-f2jx\nGHSA-6mfm-98wv-32wm\nGHSA-792x-6vq6-j8r9\nGHSA-8qq9-r6cc-qjv9\nGHSA-9wxp-w4px-32vh\nGHSA-c3qh-j9ww-qf82\nGHSA-g5c4-g774-r8rq\nGHSA-gg9r-wr4p-w63h\nGHSA-ggg2-9786-hwc8\nGHSA-hc7f-qwfj-7fcf\nGHSA-hw5c-xm3c-v96w\nGHSA-j8rf-h5jg-xxh6\nGHSA-jx2q-67wh-xh52\nGHSA-m39w-hqxx-3r48\nGHSA-m3jg-hc42-77v3\nGHSA-p7qj-2q5w-f9r7\nGHSA-phxq-526m-79px\nGHSA-px92-q6rc-6mwv\nGHSA-vmg6-wpcq-g357\nGHSA-vww4-r7gr-9xvq\nGHSA-whpp-xv3h-rwxf"
+    },
+    "GHSA-H738-VH6G-Q8GH": {
+      "358d918909a25d99db4423b6ff02df8d1a6c0a86": "Improve GHSA-h738-vh6g-q8gh",
+      "a5af41ec45be54e740d545fd822930705bad3456": "Publish Advisories\n\nGHSA-9wjq-f6rc-86wf\nGHSA-37rq-xcjg-hcf6\nGHSA-3jf9-378m-4gh9\nGHSA-4fjw-jq8h-7h3f\nGHSA-6659-73gf-7pwg\nGHSA-69fj-7q6w-ccg6\nGHSA-9r55-p3jw-v652\nGHSA-9vvg-8c87-463f\nGHSA-h738-vh6g-q8gh\nGHSA-h82q-53pj-q2j2\nGHSA-h9wj-x3qv-rhcc\nGHSA-j482-hm6j-v5jj\nGHSA-jvpw-cpgf-j2vc\nGHSA-m73p-xg7q-m8f2\nGHSA-mcx7-4f56-9589\nGHSA-p342-gc5g-728w\nGHSA-qc8f-gmjh-692q\nGHSA-qm48-7h7g-j5m2\nGHSA-qm7h-f635-h2r6\nGHSA-r8c9-g283-4f2r\nGHSA-vj56-2hgh-hfqf\nGHSA-vwpr-fv2p-8c56\nGHSA-xgjm-4322-4ccq"
+    },
+    "GHSA-V9X8-262P-F2G5": {
+      "573dbc07ab00970564dc42698a5d3e6b5d0fde54": "Improve GHSA-v9x8-262p-f2g5"
+    },
+    "GHSA-F37P-PC7R-RGHM": {
+      "e3fedf29f5ccdcdcc27c9dd56e79a2e5ceebb24c": "Improve GHSA-f37p-pc7r-rghm"
+    },
+    "GHSA-F2M9-WCF4-CWWX": {
+      "13c9f0ab68d3cb17f944ddaae9aad658e0e8d563": "Improve GHSA-f2m9-wcf4-cwwx",
+      "e45194612706243b4a5e7eeacfe6a768a2a948be": "Publish Advisories\n\nGHSA-7j2f-6h2r-6cqc\nGHSA-f2m9-wcf4-cwwx\nGHSA-qjvr-435c-5fjh",
+      "375895c027d939d2313e88a9d6e44f51c1a160d9": "Publish Advisories\n\nGHSA-2r69-qgv3-hr65\nGHSA-3w8m-3w76-f6mh\nGHSA-4524-x6pc-rr9x\nGHSA-5624-2pmv-jx46\nGHSA-67gq-6q8c-qqh6\nGHSA-7vv4-j48f-wcx7\nGHSA-8jr4-6r33-phwm\nGHSA-9ccf-75hj-3v32\nGHSA-cjvq-x32c-xrmv\nGHSA-f2m9-wcf4-cwwx\nGHSA-f378-wf84-8j5h\nGHSA-hx5c-g9jj-chxv\nGHSA-p5qq-v9mc-39ff\nGHSA-qc73-55rc-fgph"
+    },
+    "GHSA-JPJM-C3R5-Q96R": {
+      "224ffa3e2598df9503174e8be698a8a528a76e22": "Improve GHSA-jpjm-c3r5-q96r"
+    },
     "GHSA-73HR-7685-XWJ3": {
       "9c793ece78771dc0df0bf8d1808fa9590007ac2b": "Publish Advisories\n\nGHSA-73hr-7685-xwj3\nGHSA-v2fq-q39g-3748"
     },
@@ -84,11 +130,6 @@
       "3eaa1ef4b7fbd72ecd2faf01f9211e79f2a3f6af": "Publish Advisories\n\nGHSA-c4r5-fxqw-vh93\nGHSA-m959-cc7f-wv43\nGHSA-qh6h-p6c9-ff54\nGHSA-qj8w-gfj5-8c6v\nGHSA-x34h-54cw-9825\nGHSA-x744-4wpc-v9h2\nGHSA-xmgr-9pqc-h5vw",
       "e394c14025a31210c549e8c78fca9419d8fbcc23": "Publish GHSA-x744-4wpc-v9h2"
     },
-    "GHSA-792X-6VQ6-J8R9": {
-      "c6b66e4b27e3a87af84e028ed373dfa671448e9b": "Improve GHSA-792x-6vq6-j8r9",
-      "fcdc354056acda71ce0aa768f1a6d67f6d7c2f36": "Publish Advisories\n\nGHSA-792x-6vq6-j8r9\nGHSA-mvq4-39wx-6h5g\nGHSA-6v4j-43gg-vj32\nGHSA-792x-6vq6-j8r9",
-      "c955e2e4d0c901b5ba1f8a62d562523ce1f01fad": "Publish Advisories\n\nGHSA-hq3q-62v8-pp48\nGHSA-2mpf-m756-hxjm\nGHSA-5vq9-cj6j-3h3r\nGHSA-5x25-c2rf-f2jx\nGHSA-6mfm-98wv-32wm\nGHSA-792x-6vq6-j8r9\nGHSA-8qq9-r6cc-qjv9\nGHSA-9wxp-w4px-32vh\nGHSA-c3qh-j9ww-qf82\nGHSA-g5c4-g774-r8rq\nGHSA-gg9r-wr4p-w63h\nGHSA-ggg2-9786-hwc8\nGHSA-hc7f-qwfj-7fcf\nGHSA-hw5c-xm3c-v96w\nGHSA-j8rf-h5jg-xxh6\nGHSA-jx2q-67wh-xh52\nGHSA-m39w-hqxx-3r48\nGHSA-m3jg-hc42-77v3\nGHSA-p7qj-2q5w-f9r7\nGHSA-phxq-526m-79px\nGHSA-px92-q6rc-6mwv\nGHSA-vmg6-wpcq-g357\nGHSA-vww4-r7gr-9xvq\nGHSA-whpp-xv3h-rwxf"
-    },
     "GHSA-QWWW-VCR4-C8H2": {
       "4da50480fc88ef6733f73e6cd547ac92f613a0e5": "Improve GHSA-qwww-vcr4-c8h2",
       "02ed867ff3261d2dfdd27361617c9d5be6cc80f0": "Publish Advisories\n\nGHSA-464c-974j-9xm6\nGHSA-5xvq-cp9x-6p6r\nGHSA-83w8-p2f5-377r\nGHSA-8pvw-jcv7-9cmj\nGHSA-qwww-vcr4-c8h2\nGHSA-r9mr-m37c-5fr3"
@@ -4693,9 +4734,6 @@
     "GHSA-9R55-P3JW-V652": {
       "a5af41ec45be54e740d545fd822930705bad3456": "Publish Advisories\n\nGHSA-9wjq-f6rc-86wf\nGHSA-37rq-xcjg-hcf6\nGHSA-3jf9-378m-4gh9\nGHSA-4fjw-jq8h-7h3f\nGHSA-6659-73gf-7pwg\nGHSA-69fj-7q6w-ccg6\nGHSA-9r55-p3jw-v652\nGHSA-9vvg-8c87-463f\nGHSA-h738-vh6g-q8gh\nGHSA-h82q-53pj-q2j2\nGHSA-h9wj-x3qv-rhcc\nGHSA-j482-hm6j-v5jj\nGHSA-jvpw-cpgf-j2vc\nGHSA-m73p-xg7q-m8f2\nGHSA-mcx7-4f56-9589\nGHSA-p342-gc5g-728w\nGHSA-qc8f-gmjh-692q\nGHSA-qm48-7h7g-j5m2\nGHSA-qm7h-f635-h2r6\nGHSA-r8c9-g283-4f2r\nGHSA-vj56-2hgh-hfqf\nGHSA-vwpr-fv2p-8c56\nGHSA-xgjm-4322-4ccq"
     },
-    "GHSA-H738-VH6G-Q8GH": {
-      "a5af41ec45be54e740d545fd822930705bad3456": "Publish Advisories\n\nGHSA-9wjq-f6rc-86wf\nGHSA-37rq-xcjg-hcf6\nGHSA-3jf9-378m-4gh9\nGHSA-4fjw-jq8h-7h3f\nGHSA-6659-73gf-7pwg\nGHSA-69fj-7q6w-ccg6\nGHSA-9r55-p3jw-v652\nGHSA-9vvg-8c87-463f\nGHSA-h738-vh6g-q8gh\nGHSA-h82q-53pj-q2j2\nGHSA-h9wj-x3qv-rhcc\nGHSA-j482-hm6j-v5jj\nGHSA-jvpw-cpgf-j2vc\nGHSA-m73p-xg7q-m8f2\nGHSA-mcx7-4f56-9589\nGHSA-p342-gc5g-728w\nGHSA-qc8f-gmjh-692q\nGHSA-qm48-7h7g-j5m2\nGHSA-qm7h-f635-h2r6\nGHSA-r8c9-g283-4f2r\nGHSA-vj56-2hgh-hfqf\nGHSA-vwpr-fv2p-8c56\nGHSA-xgjm-4322-4ccq"
-    },
     "GHSA-H9WJ-X3QV-RHCC": {
       "a5af41ec45be54e740d545fd822930705bad3456": "Publish Advisories\n\nGHSA-9wjq-f6rc-86wf\nGHSA-37rq-xcjg-hcf6\nGHSA-3jf9-378m-4gh9\nGHSA-4fjw-jq8h-7h3f\nGHSA-6659-73gf-7pwg\nGHSA-69fj-7q6w-ccg6\nGHSA-9r55-p3jw-v652\nGHSA-9vvg-8c87-463f\nGHSA-h738-vh6g-q8gh\nGHSA-h82q-53pj-q2j2\nGHSA-h9wj-x3qv-rhcc\nGHSA-j482-hm6j-v5jj\nGHSA-jvpw-cpgf-j2vc\nGHSA-m73p-xg7q-m8f2\nGHSA-mcx7-4f56-9589\nGHSA-p342-gc5g-728w\nGHSA-qc8f-gmjh-692q\nGHSA-qm48-7h7g-j5m2\nGHSA-qm7h-f635-h2r6\nGHSA-r8c9-g283-4f2r\nGHSA-vj56-2hgh-hfqf\nGHSA-vwpr-fv2p-8c56\nGHSA-xgjm-4322-4ccq"
     },
@@ -7470,12 +7508,6 @@
       "590287da350c4374e5a81c12e7ba3174523f64a9": "Publish GHSA-v5pm-xwqc-g5wc",
       "356cc14d2284de81be785774b825f18ae23c6e95": "Publish GHSA-v5pm-xwqc-g5wc"
     },
-    "GHSA-9342-92GG-6V29": {
-      "074c54ac2e87fdf21d5ed993503e6665ae57d014": "Improve GHSA-9342-92gg-6v29",
-      "6737202d6337c10cfc993aa927a863e726d85c3a": "Publish GHSA-9342-92gg-6v29",
-      "f103ccecc9305b9526f4fd3c273e524f1f7a9593": "Publish Advisories\n\nGHSA-67jc-hmvg-q4c7\nGHSA-72ww-4rcw-mc62\nGHSA-9342-92gg-6v29\nGHSA-cx25-xg7c-xfm5\nGHSA-rrff-chj9-w4c7\nGHSA-jr43-q92q-5q82\nGHSA-p288-459w-jxj6\nGHSA-xg8j-j6vp-6h5w",
-      "706c715bb73e0443b06e5cc0e384c9cbab3260a4": "Publish Advisories\n\nGHSA-9342-92gg-6v29\nGHSA-qj5r-2r5p-phc7\nGHSA-9342-92gg-6v29"
-    },
     "GHSA-WQJX-HRCH-347F": {
       "bed4f27c1a7cf06ce9885513f694a6b9ad37fd1b": "Improve GHSA-wqjx-hrch-347f"
     },
@@ -20057,10 +20089,6 @@
       "315f92d7e0ed5d03b8855d89789ffbaf6ba24709": "Publish GHSA-2r69-qgv3-hr65",
       "375895c027d939d2313e88a9d6e44f51c1a160d9": "Publish Advisories\n\nGHSA-2r69-qgv3-hr65\nGHSA-3w8m-3w76-f6mh\nGHSA-4524-x6pc-rr9x\nGHSA-5624-2pmv-jx46\nGHSA-67gq-6q8c-qqh6\nGHSA-7vv4-j48f-wcx7\nGHSA-8jr4-6r33-phwm\nGHSA-9ccf-75hj-3v32\nGHSA-cjvq-x32c-xrmv\nGHSA-f2m9-wcf4-cwwx\nGHSA-f378-wf84-8j5h\nGHSA-hx5c-g9jj-chxv\nGHSA-p5qq-v9mc-39ff\nGHSA-qc73-55rc-fgph"
     },
-    "GHSA-F2M9-WCF4-CWWX": {
-      "e45194612706243b4a5e7eeacfe6a768a2a948be": "Publish Advisories\n\nGHSA-7j2f-6h2r-6cqc\nGHSA-f2m9-wcf4-cwwx\nGHSA-qjvr-435c-5fjh",
-      "375895c027d939d2313e88a9d6e44f51c1a160d9": "Publish Advisories\n\nGHSA-2r69-qgv3-hr65\nGHSA-3w8m-3w76-f6mh\nGHSA-4524-x6pc-rr9x\nGHSA-5624-2pmv-jx46\nGHSA-67gq-6q8c-qqh6\nGHSA-7vv4-j48f-wcx7\nGHSA-8jr4-6r33-phwm\nGHSA-9ccf-75hj-3v32\nGHSA-cjvq-x32c-xrmv\nGHSA-f2m9-wcf4-cwwx\nGHSA-f378-wf84-8j5h\nGHSA-hx5c-g9jj-chxv\nGHSA-p5qq-v9mc-39ff\nGHSA-qc73-55rc-fgph"
-    },
     "GHSA-QJVR-435C-5FJH": {
       "e45194612706243b4a5e7eeacfe6a768a2a948be": "Publish Advisories\n\nGHSA-7j2f-6h2r-6cqc\nGHSA-f2m9-wcf4-cwwx\nGHSA-qjvr-435c-5fjh"
     },

data/fix-commits/bc-java-fd129cd9.json

@@ -1,6 +1,13 @@
 {
   "vcs_url": "https://github.com/bcgit/bc-java",
   "vulnerabilities": {
+    "CVE-2024-29857": {
+      "22db5b9594127e5774d246bb596df36db313f42b": "Add Properties.EC_MAX_F2M_FIELD_SIZE for the org.bouncycastle.ec.max_f2m_field_size F2m field size bound (CVE-2024-29857) and use it in ECCurve rather than the inlined literal, mirroring the constant into the jdk1.4 overlay.",
+      "b1e21a374d8672486afa7789d77f4ff26bf2416d": "Add missing 1.78 defects-fixed entries for CVE-2024-14041 (KyberSlash) and CVE-2024-29857 (F2m field size), cross-reference every 1.78 advisory CVE from its defects-fixed entry, and credit the Robusta team's constant-time analysis."
+    },
+    "CVE-2024-14041": {
+      "b1e21a374d8672486afa7789d77f4ff26bf2416d": "Add missing 1.78 defects-fixed entries for CVE-2024-14041 (KyberSlash) and CVE-2024-29857 (F2m field size), cross-reference every 1.78 advisory CVE from its defects-fixed entry, and credit the Robusta team's constant-time analysis."
+    },
     "CVE-2026-3505": {
       "71b8e3657adce9828102d33772f290bfc60a1004": "Revert \"OpenPGP v6 SEIPDv2 AEAD chunkSize is unbounded on decrypt \u2192 1L<<(chunkSize+6) buffer: chunkSize 24 \u2192 1 GiB alloc (memory-DoS), 25 \u2192 NegativeArraySizeException. Concrete sibling asymmetry: v5 AEADEncDataPacket:51 has if (chunkSize > 16) throw (CVE-2026-3505) but v6 SymmetricEncIntegrityPacket:54 reads chunkSize=in.read() with no bound \u2014 the missed sibling. Attacker needs only the recipient's public key.\"\n\nThis reverts commit 1299519c70c21b4b56296762295528124f5825a7.",
       "1299519c70c21b4b56296762295528124f5825a7": "OpenPGP v6 SEIPDv2 AEAD chunkSize is unbounded on decrypt \u2192 1L<<(chunkSize+6) buffer: chunkSize 24 \u2192 1 GiB alloc (memory-DoS), 25 \u2192 NegativeArraySizeException. Concrete sibling asymmetry: v5 AEADEncDataPacket:51 has if (chunkSize > 16) throw (CVE-2026-3505) but v6 SymmetricEncIntegrityPacket:54 reads chunkSize=in.read() with no bound \u2014 the missed sibling. Attacker needs only the recipient's public key."