.openvex.json

{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://github.com/NVIDIA/aicr/.openvex.json",
  "author": "NVIDIA AICR maintainers",
  "role": "document creator",
  "timestamp": "2026-08-06T00:00:00Z",
  "version": 13,
  "tooling": "manual; aiperf-bench statements verified against aiperf v0.11.0 source (which pins pillow~=12.2.0); the aiperf-bench runtime base moved from python:3.13-slim to nvcr.io/nvidia/distroless/python:3.13-v4.0.8, adding 21 libexpat1 2.7.1-2 statements (4 High, 16 Medium, 1 Low) whose unreachability was verified by reading ELF DT_NEEDED across the built image (no binary links libexpat) and by confirming CPython's pyexpat statically bundles expat 2.8.1; aicr statement reachability verified by source inspection (CGO-free ko build, no libssl linkage); v11 added aiperf-bench CVE-2026-11940 and CVE-2026-11972 (CPython 3.13.14 tarfile), justified vulnerable_code_not_in_execute_path after confirming aiperf 0.11.0 has zero tarfile references and that AICR's fixed `aiperf profile` argv lands in the synthetic-dataset branch of aiperf/dataset/dataset_manager.py, never downloading or extracting an archive; v12 removed ALL 47 pkg:oci/aicr-gate statements: #2038 deleted the embedded upstream kyverno/chainsaw binary from cmd/gate/Dockerfile (the gate now evaluates Chainsaw Test assertions in-process via pkg/chainsaw), so every package those statements scoped to that binary — including GO-2026-5942 (golang.org/x/net) and GO-2026-5970 (golang.org/x/text), the two HIGH findings the weekly scan reported on aicr-gate — is component_not_present rather than suppressed. The aicr-gate image now ships only the statically linked Go gate binary built from this module's pins, so a future finding on it must be fixed by a dependency bump, not re-suppressed. Confirmation is the first Weekly Image Vulnerability Scan run after merge: aicr-gate must report 0 HIGH+ and 0 VEX-suppressed. v13 added aiperf-bench GHSA-cq5v-8q36-5273 (aiohttp 3.13.5 C-parser out-of-bounds read) and is the first statement in this document justified vulnerable_code_cannot_be_controlled_by_adversary rather than vulnerable_code_not_in_execute_path: the compiled C parser does parse every benchmark response, so the claim rests on every aiohttp peer being a cluster-internal workload discovered through the Kubernetes API. The v13 stale audit re-scanned ghcr.io/nvidia/aicr-validators/aiperf-bench:scan-90ef73c8 with the pinned grype 0.110.0 and found all 34 pre-existing statements still applied (declared and applied sets identical, zero stale). aiperf-bench is now the only product in this document, so no other image needs auditing.",
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-15308",
        "description": "cpython CPU-exhaustion DoS in html.parser.HTMLParser incremental feed() via repeated unterminated markup declarations (PSF-2026-33, CWE-407, High CVSS 7.5/8.7). Fix merged to the cpython 3.13 branch on 2026-07-04 (PR #153040) but as of 2026-07-13 no released CPython contains it — v3.13.14 (2026-06-10), v3.14.6, and v3.15.0b3 all predate the fix, so no base-image bump can remediate yet."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The trigger requires incrementally feeding attacker-controlled HTML containing repeated unterminated markup declarations into html.parser.HTMLParser.feed(). aiperf 0.11.0 source contains zero references to html.parser, HTMLParser, or any html stdlib import (verified with `grep -rn -E 'html\\.parser|HTMLParser|^(import|from) html'` against the aiperf 0.11.0 wheel — no hits). AICR invokes aiperf-bench exclusively as `aiperf profile <text-LLM> --url <endpoint>` (validators/performance/inference_perf_constraint.go); the workload exchanges only JSON over HTTP via aiohttp + msgspec/orjson and never parses HTML documents from the inference endpoint or any other source. No attacker-controlled markup can reach the vulnerable parser, so the quadratic-complexity code path is unreachable."
    },
    {
      "vulnerability": {
        "name": "GHSA-vjc4-5qp5-m44j",
        "description": "pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service (CVE-2026-59204, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. JPEG2000 decode is reached only by opening JP2/J2K inputs; aiperf's ImageFormat allowlist (aiperf/common/enums/enums.py) permits only PNG and JPEG, and `grep -riE 'jp2|jpeg2000' aiperf/ (the 0.11.0 wheel)` returns zero hits."
    },
    {
      "vulnerability": {
        "name": "GHSA-xj96-63gp-2gmr",
        "description": "pillow heap out-of-bounds write in ImageFilter.RankFilter via integer overflow in ImagingExpand (CVE-2026-59197, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. The vulnerable entry point is ImageFilter.RankFilter; `grep -rn 'ImageFilter' aiperf/ (the 0.11.0 wheel)` returns zero hits."
    },
    {
      "vulnerability": {
        "name": "GHSA-62p4-gmf7-7g93",
        "description": "pillow out-of-bounds read via attacker-controlled row stride on the mmap path for McIdas AREA files (CVE-2026-54058, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. Triggering requires opening a McIdas AREA file; `grep -rn 'McIdas' aiperf/ (the 0.11.0 wheel)` returns zero hits and the ImageFormat allowlist permits only PNG and JPEG."
    },
    {
      "vulnerability": {
        "name": "GHSA-6r8x-57c9-28j4",
        "description": "pillow heap out-of-bounds write in Image.paste()/Image.crop() via signed coordinate overflow (CVE-2026-59199, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. `grep -rnE '\\.paste\\(|\\.crop\\(' aiperf/ (the 0.11.0 wheel)` returns zero hits — aiperf never calls the vulnerable methods."
    },
    {
      "vulnerability": {
        "name": "GHSA-9hw9-ch79-4vh6",
        "description": "pillow controlled heap out-of-bounds write in ImageCmsTransform.apply() via output mode mismatch (CVE-2026-59205, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. The vulnerable entry point is the ImageCms color-management module; `grep -rn 'ImageCms' aiperf/ (the 0.11.0 wheel)` returns zero hits."
    },
    {
      "vulnerability": {
        "name": "GHSA-45hq-cxwh-f6vc",
        "description": "pillow BdfFontFile: Image.new() called without decompression-bomb check — bomb protection bypass via BDF font loading (CVE-2026-55379, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. The vulnerable path is pillow's external font-file parsing; aiperf imports only PIL.Image, PIL.ImageDraw, and PIL.UnidentifiedImageError — `grep -rnE 'ImageFont|BdfFontFile|PcfFontFile|FontFile' aiperf/ (the 0.11.0 wheel)` returns zero hits, so no external font file is ever parsed."
    },
    {
      "vulnerability": {
        "name": "GHSA-5x94-69rx-g8h2",
        "description": "pillow FontFile.compile(): Image.new() called without decompression-bomb check (CVE-2026-54060, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. The vulnerable path is pillow's external font-file parsing; aiperf imports only PIL.Image, PIL.ImageDraw, and PIL.UnidentifiedImageError — `grep -rnE 'ImageFont|BdfFontFile|PcfFontFile|FontFile' aiperf/ (the 0.11.0 wheel)` returns zero hits, so no external font file is ever parsed."
    },
    {
      "vulnerability": {
        "name": "GHSA-phj9-mv4w-65pm",
        "description": "pillow GdImageFile._open(): image dimensions accepted without decompression-bomb check (CVE-2026-55380, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. GD images are not auto-registered with Image.open; the vulnerable path requires explicit PIL.GdImageFile usage — `grep -rn 'GdImageFile' aiperf/ (the 0.11.0 wheel)` returns zero hits."
    },
    {
      "vulnerability": {
        "name": "GHSA-8v84-f9pq-wr9x",
        "description": "pillow PcfFontFile._load_bitmaps(): Image.frombytes() called without decompression-bomb check — bomb protection bypass via PCF font loading (CVE-2026-54059, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. The vulnerable path is pillow's external font-file parsing; aiperf imports only PIL.Image, PIL.ImageDraw, and PIL.UnidentifiedImageError — `grep -rnE 'ImageFont|BdfFontFile|PcfFontFile|FontFile' aiperf/ (the 0.11.0 wheel)` returns zero hits, so no external font file is ever parsed."
    },
    {
      "vulnerability": {
        "name": "GHSA-jjj6-mw9f-p565",
        "description": "pillow decompression-bomb denial of service via PdfParser.PdfStream.decode() (CVE-2026-59200, High). Fixed in pillow 12.3.0, which is unreachable: aiperf 0.11.0 pins pillow~=12.2.0."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The aiperf-bench workload is the text-LLM benchmark `aiperf profile <model> --url ...` invoked by validators/performance/inference_perf_constraint.go; pillow is imported only by aiperf.dataset modules (dataset/utils.py, dataset/dataset_manager.py, dataset/generator/{image,video}.py, dataset/loader/base_hf_dataset.py) for synthetic multimodal dataset generation and HF dataset loading, neither of which the AICR text-LLM workload configures. PdfParser runs only when reading or appending to existing PDF files; `grep -rnE 'PdfParser|\\.pdf' aiperf/ (the 0.11.0 wheel)` returns zero hits and the ImageFormat allowlist permits only PNG and JPEG."
    },
    {
      "vulnerability": {
        "name": "CVE-2025-59375",
        "description": "libexpat before 2.7.2 allows attackers to trigger large dynamic memory allocations via a small document submitted for parsing (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Reaching the allocation amplification requires feeding a crafted XML document to expat's parser. The aiperf-bench runtime base moved to nvcr.io/nvidia/distroless/python:3.13-v4.0.8, which ships Debian libexpat1 2.7.1-2 (fixed upstream in 2.8.2-1~deb13u1). The package cannot be bumped from this repo: it comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, so no base-image bump remediates it today. Two independent facts make the vulnerable build unreachable. (1) Nothing in the image links it: reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 (2.7.1-2) is never loaded. (2) The one XML path that does execute does not use it: CPython routes xml.parsers.expat through lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled at EXPAT_VERSION 2.8.1. So the 14 venv packages that import xml.* (PIL, matplotlib, pandas, fontTools, pyarrow, datasets, ...) exercise that bundled build, not the flagged 2.7.1-2 package. Whether 2.8.1 is itself patched varies by CVE and is stated per statement below. aiperf itself imports no XML module at all: scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits. AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP; no XML document from any source reaches a parser. The statically bundled expat is 2.8.1, above this CVE's 2.7.2 fix threshold, so even the reachable XML path is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-45186",
        "description": "libexpat before 2.8.1: the computational complexity of attribute name collision checks allows denial of service via moderately sized crafted XML input (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The trigger requires parsing crafted XML with colliding attribute names. The aiperf-bench runtime base moved to nvcr.io/nvidia/distroless/python:3.13-v4.0.8, which ships Debian libexpat1 2.7.1-2 (fixed upstream in 2.8.2-1~deb13u1). The package cannot be bumped from this repo: it comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, so no base-image bump remediates it today. Two independent facts make the vulnerable build unreachable. (1) Nothing in the image links it: reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 (2.7.1-2) is never loaded. (2) The one XML path that does execute does not use it: CPython routes xml.parsers.expat through lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled at EXPAT_VERSION 2.8.1. So the 14 venv packages that import xml.* (PIL, matplotlib, pandas, fontTools, pyarrow, datasets, ...) exercise that bundled build, not the flagged 2.7.1-2 package. Whether 2.8.1 is itself patched varies by CVE and is stated per statement below. aiperf itself imports no XML module at all: scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits. AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP; no XML document from any source reaches a parser. The statically bundled expat is exactly 2.8.1, this CVE's fix threshold, so the reachable XML path is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-41080",
        "description": "libexpat before 2.8.0 uses insufficient entropy, allowing hash flooding via a crafted XML document (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L). Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Hash flooding requires the attacker to supply a crafted XML document to the parser. The aiperf-bench runtime base moved to nvcr.io/nvidia/distroless/python:3.13-v4.0.8, which ships Debian libexpat1 2.7.1-2 (fixed upstream in 2.8.2-1~deb13u1). The package cannot be bumped from this repo: it comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, so no base-image bump remediates it today. Two independent facts make the vulnerable build unreachable. (1) Nothing in the image links it: reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 (2.7.1-2) is never loaded. (2) The one XML path that does execute does not use it: CPython routes xml.parsers.expat through lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled at EXPAT_VERSION 2.8.1. So the 14 venv packages that import xml.* (PIL, matplotlib, pandas, fontTools, pyarrow, datasets, ...) exercise that bundled build, not the flagged 2.7.1-2 package. Whether 2.8.1 is itself patched varies by CVE and is stated per statement below. aiperf itself imports no XML module at all: scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits. AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP; no XML document from any source reaches a parser. The statically bundled expat is 2.8.1, above this CVE's 2.8.0 fix threshold, so even the reachable XML path is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-25210",
        "description": "libexpat before 2.7.4: doContent does not correctly determine bufSize because the tag buffer reallocation lacks an integer overflow check (CVSS 3.1 AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L). Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Overflowing the tag buffer requires driving expat's doContent with crafted XML element content. The aiperf-bench runtime base moved to nvcr.io/nvidia/distroless/python:3.13-v4.0.8, which ships Debian libexpat1 2.7.1-2 (fixed upstream in 2.8.2-1~deb13u1). The package cannot be bumped from this repo: it comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, so no base-image bump remediates it today. Two independent facts make the vulnerable build unreachable. (1) Nothing in the image links it: reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 (2.7.1-2) is never loaded. (2) The one XML path that does execute does not use it: CPython routes xml.parsers.expat through lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled at EXPAT_VERSION 2.8.1. So the 14 venv packages that import xml.* (PIL, matplotlib, pandas, fontTools, pyarrow, datasets, ...) exercise that bundled build, not the flagged 2.7.1-2 package. Whether 2.8.1 is itself patched varies by CVE and is stated per statement below. aiperf itself imports no XML module at all: scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits. AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP; no XML document from any source reaches a parser. The statically bundled expat is 2.8.1, above this CVE's 2.7.4 fix threshold, so even the reachable XML path is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-24515",
        "description": "In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Independently, the statically bundled expat is EXPAT_VERSION 2.8.1, at or above this CVE's 2.7.4 fix threshold, so even the XML path that does execute is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32776",
        "description": "libexpat before 2.7.5 allows a NULL pointer dereference with empty external parameter entity content. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Independently, the statically bundled expat is EXPAT_VERSION 2.8.1, at or above this CVE's 2.7.5 fix threshold, so even the XML path that does execute is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32777",
        "description": "libexpat before 2.7.5 allows an infinite loop while parsing DTD content. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Independently, the statically bundled expat is EXPAT_VERSION 2.8.1, at or above this CVE's 2.7.5 fix threshold, so even the XML path that does execute is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-32778",
        "description": "libexpat before 2.7.5 allows a NULL pointer dereference in the function setContext on retry after an earlier ouf-of-memory condition. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Independently, the statically bundled expat is EXPAT_VERSION 2.8.1, at or above this CVE's 2.7.5 fix threshold, so even the XML path that does execute is already patched."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-50219",
        "description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_GetBuffer, XML_Parse, XML_ParseBuffer, XML_ParserFree, or XML_ParserReset from within handlers in cases of a policy violation. Thus, a use-after-free can occur, Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56131",
        "description": "libexpat before 2.8.2 lacks handler call depth tracking for calls to XML_ResumeParser from within handlers in cases of a policy violation. Thus, a use-after-free can occur (similar to the CVE-2026-50219 situation). Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56132",
        "description": "In libexpat before 2.8.2, there is a heap-based buffer overflow in doProlog in xmlparse.c because scaffold backing array reallocation is mishandled when there is data-structure sharing across parsers. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56403",
        "description": "libexpat before 2.8.2 has an integer overflow in storeAtts. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56404",
        "description": "libexpat before 2.8.2 has an integer overflow in addBinding. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56405",
        "description": "libexpat before 2.8.2 has an integer overflow in getAttributeId. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56406",
        "description": "libexpat before 2.8.2 has an integer overflow in XML_ParseBuffer because it lacked a check that was present in XML_Parse. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56407",
        "description": "libexpat before 2.8.2 has an integer overflow in doProlog that is related to storeEntityValue and entity textLen. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56408",
        "description": "libexpat before 2.8.2 has an integer overflow in copyString. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56409",
        "description": "xmlwf in libexpat before 2.8.2 has an integer overflow for the output filename when -d outputDir is used. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56410",
        "description": "xmlwf in libexpat before 2.8.2 has an integer overflow in resolveSystemId. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56411",
        "description": "xmlwf in libexpat before 2.8.2 has an integer overflow in endDoctypeDecl via NOTATION declarations. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-56412",
        "description": "libexpat before 2.8.2 does not consider XML_TOK_DATA_CHARS in doCdataSection and thus lacks handler call depth tracking for various calls from within handlers in cases of a policy violation. Thus, a use-after-free can occur. NOTE: this issue exists because of an incomplete fix for CVE-2026-50219. Present via Debian libexpat1 2.7.1-2 in the distroless runtime base; fixed in 2.8.2-1~deb13u1. CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "The flagged package is Debian libexpat1 2.7.1-2, shipped by the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base and fixed upstream in 2.8.2-1~deb13u1. It cannot be bumped from this repo: the package comes from NVIDIA's published distroless image and 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io. The vulnerable build is never executed because nothing in the image links it -- reading ELF DT_NEEDED entries for every binary under /usr/local/lib, /usr/lib, /lib, /opt/venv/lib, /usr/local/bin, and /usr/bin returns zero references to libexpat, so /usr/lib/x86_64-linux-gnu/libexpat.so.1 is dead weight on disk. CPython does not use it either: xml.parsers.expat resolves to lib-dynload/pyexpat.cpython-313-x86_64-linux-gnu.so, whose DT_NEEDED is ['libc.so.6'] only because expat is statically bundled. aiperf itself imports no XML module -- scanning its 682 .py files for '^(import|from) (xml|pyexpat|xmlrpc)' returns zero hits -- and AICR invokes the image only as `aiperf profile <text-LLM> --url <endpoint>` (buildAIPerfJob in validators/performance/inference_perf_constraint.go), exchanging JSON over HTTP. No XML document from any source reaches a parser. Note: CPython's statically bundled expat is 2.8.1 and this CVE is fixed in 2.8.2, so the bundled copy is not itself patched. That copy is invisible to package scanners and is not what this finding reports; the finding is scoped to the unused Debian libexpat1 package above. The bundled parser is unreachable for the separate reason that neither aiperf nor the benchmark workload parses XML from any source."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-11940",
        "description": "cpython: tarfile.extractall() under the 'data' or 'tar' filter can be bypassed by a crafted archive in which a hardlink references a symlink stored at a deeper name than the hardlink itself, letting the recreated symlink escape the destination directory (GHSA-9mc4-rqmq-h467, High; incomplete fix of CVE-2025-4330). Present via CPython 3.13.14 in the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base. No bump remediates: 3.13.14 is the newest CPython 3.13 release, 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, grype's only known fixed version is 3.15.0b4 (an unreleased beta), and scanning the newest 3.14-line tag (3.14-v4.0.9, CPython 3.14.6) reports this same finding, so no minor-version move escapes it either."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Triggering this requires extracting an attacker-supplied tar archive with tarfile.extractall(). aiperf 0.11.0 never touches tarfile: grepping the installed package at /opt/venv/lib/python3.13/site-packages/aiperf for 'tarfile|extractall' returns zero hits. Across the entire venv (297 installed distributions) exactly one tar extraction exists -- datasets/utils/extract.py:130-131, TarExtractor.extract, which does `tarfile.open(input_path)` then `tar_file.extractall(output_path, members=TarExtractor.safemembers(tar_file, output_path))` -- inside the HuggingFace `datasets` package. aiperf declares that dependency (Requires-Dist: datasets>=3.0) but imports it from only two regions: the HuggingFace dataset loaders (aiperf/dataset/loader/base_hf_dataset.py, aiperf/dataset/loader/hf_asr.py) and the accuracy benchmark suites (aiperf/accuracy/benchmarks/{mmlu,gsm8k,aime,aime24,aime25,hellaswag,gpqa_diamond,math_500}.py). AICR reaches neither. buildAIPerfJob (validators/performance/inference_perf_constraint.go) launches the image with a fixed argv -- `aiperf profile --model <model> --url <endpoint> --endpoint-type chat --streaming --concurrency N --request-count N --warmup-request-count N --prompt-input-tokens-mean 128 --prompt-input-tokens-stddev 0 --prompt-output-tokens-mean 128 --prompt-output-tokens-stddev 0 --num-dataset-entries 100 --random-seed 100 --extra-inputs temperature:0 --output-artifact-dir /tmp/aiperf --export-level summary` -- with no --input-file, no public-dataset selector, and no accuracy flag. aiperf's dataset dispatch (aiperf/dataset/dataset_manager.py:444-456) therefore falls past the accuracy-enabled, PublicDataset, and FileDataset branches into _load_synthetic_dataset(), which generates prompts in-process from --random-seed and --num-dataset-entries. No archive is fetched and no tar is opened anywhere in the benchmark run. Note on the CVE's precondition: it describes a bypass of the 'data'/'tar' extraction filter, and that single call site passes no filter= argument at all (it screens members itself via safemembers), so the filter the CVE defeats is not the mechanism in use there -- but the operative reason this image is unaffected is that the call site is never executed by AICR's workload."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-11972",
        "description": "cpython: when the tarfile module is used with a file opened in streaming mode (mode='r|'), tarfile does not properly handle EOF, so a crafted archive can be parsed in an infinite loop (GHSA-wqxf-pjxh-hh4h, High). Present via CPython 3.13.14 in the nvcr.io/nvidia/distroless/python:3.13-v4.0.8 runtime base. No bump remediates: 3.13.14 is the newest CPython 3.13 release, 3.13-v4.0.8 is the newest 3.13 tag on nvcr.io, grype's only known fixed version is 3.15.0b4 (an unreleased beta), and the newest 3.14-line tag (3.14-v4.0.9, CPython 3.14.6) reports this same finding."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_in_execute_path",
      "impact_statement": "Triggering this requires feeding a crafted archive to tarfile with the file opened in streaming mode (mode='r|' / 'r|*'). aiperf 0.11.0 contains no tarfile usage at all: grepping the installed package at /opt/venv/lib/python3.13/site-packages/aiperf for 'tarfile|extractall' returns zero hits. Across the entire venv (297 installed distributions) exactly two streaming-mode opens exist, and neither is reachable from the benchmark. The first is datasets/utils/file_utils.py:1360, `tarfile.open(fileobj=f, mode='r|*')`, on the HuggingFace `datasets` streaming-download path; aiperf declares datasets as a dependency (Requires-Dist: datasets>=3.0) but imports it only from the HuggingFace dataset loaders (aiperf/dataset/loader/base_hf_dataset.py, aiperf/dataset/loader/hf_asr.py) and the accuracy benchmark suites (aiperf/accuracy/benchmarks/*.py). AICR invokes neither: buildAIPerfJob (validators/performance/inference_perf_constraint.go) runs a fixed argv -- `aiperf profile --model <model> --url <endpoint> --endpoint-type chat --streaming --num-dataset-entries 100 --random-seed 100 --prompt-input-tokens-mean 128 --output-artifact-dir /tmp/aiperf --export-level summary` and the remaining concurrency/token-count flags -- with no --input-file, no public-dataset selector, and no accuracy flag, so aiperf's dataset dispatch (aiperf/dataset/dataset_manager.py:444-456) falls through to _load_synthetic_dataset() and generates prompts in-process from --random-seed. Note that the --streaming flag here is an HTTP/SSE response-streaming option for the inference endpoint and has nothing to do with tarfile stream mode. The second call site is setuptools/_vendor/jaraco/context/__init__.py:79, a build-time helper in vendored setuptools; the runtime stage is distroless with no shell, no compiler, and no pip invocation -- the venv is copied in fully installed from the builder stage (validators/performance/aiperf-bench.Dockerfile), so setuptools is never executed. No tar stream from any source is parsed during a benchmark run."
    },
    {
      "vulnerability": {
        "name": "GHSA-cq5v-8q36-5273",
        "description": "aiohttp: out-of-bounds heap read in the C HTTP parser while building the error message for a malformed response, which an attacker-controlled server (or an accidentally malformed response) can turn into a client-side DoS (CVE-2026-69244, CWE-125, High CVSS 7.1). Present via aiohttp 3.13.5. Fixed only in aiohttp 3.14.3, which no bump can reach: aiperf pins `aiohttp~=3.13.3` (>=3.13.3,<3.14) in pyproject.toml at both v0.11.0 (the version installed here) and v0.12.0 (newest upstream release, 2026-08-06), so requiring 3.14.3 in validators/performance/requirements.txt would make pip resolution fail outright rather than produce a fixed image. Unlike the other statements in this document the vulnerable code IS on the execute path -- aiohttp is the benchmark's request transport -- so the claim rests on adversary control of the response bytes, not on unreachability."
      },
      "products": [
        {
          "@id": "pkg:oci/aicr-aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aicr-aiperf-bench"
          }
        },
        {
          "@id": "pkg:oci/aiperf-bench",
          "identifiers": {
            "purl": "pkg:oci/aiperf-bench"
          }
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
      "impact_statement": "The defect is in HttpParser.feed_data's error path at aiohttp/_http_parser.pyx:588-590 of 3.13.5: `after = cparser.llhttp_get_error_pos(self._cparser)` yields a raw `const char*` into the fed buffer, and the following `after.split(b\"\\r\\n\", 1)` forces an implicit char*-to-bytes conversion whose strlen() scans past the end of that buffer looking for a NUL. aio-libs/aiohttp PR #13222 (commit 49f65d5, released in 3.14.3) fixes it by slicing the snippet out of the bounded `data` object instead. This code is genuinely live in the image -- the compiled parser ships at /opt/venv/lib/python3.13/site-packages/aiohttp/_http_parser.cpython-313-x86_64-linux-gnu.so and the image config sets no AIOHTTP_NO_EXTENSIONS (verified with `crane config`), so the C parser, not the unaffected Python one, parses every benchmark response. What makes the image not_affected is that the parser only enters this branch when a peer emits a malformed HTTP message, and no peer aiperf-bench talks to is attacker-influenced. The installed aiperf 0.11.0 constructs exactly four aiohttp.ClientSession objects. (1) transports/aiohttp_client.py:139 is the benchmark request transport, shared by common/readiness_probe.py; its only target is the --url value, which buildAIPerfJob (validators/performance/inference_perf_constraint.go:2964) fills from resolveInferenceEndpoint -- a cluster-internal Service URL of the form http://<svc>.<ns>.svc:<port> discovered through the Kubernetes API by resolveFrontendEndpoint/resolveGatewayEndpoint in the same file, pointing at the Dynamo frontend or inference gateway that this same validator deployed. No recipe, snapshot, CLI flag, or environment variable can redirect it; the file's only os.Getenv bindings cover timeouts, model, router mode, cache sizing, and image resolution. (2) and (3) common/mixins/base_metrics_collector_mixin.py:294 and :413 are the GPU-telemetry and server-metrics scrapers; GpuTelemetryConfig defaults the DCGM collector to a local exporter (http://localhost:9400/metrics) and ServerMetricsDiscoveryConfig defaults to mode=auto, which enumerates eligible in-cluster inference-server pods via the Kubernetes API -- both address only workloads inside the cluster under test. (4) dataset/dataset_manager.py:269 downloads media URLs carried in the dataset and is the one session that could reach an arbitrary internet host; it is unreachable under AICR's fixed argv, which passes synthetic-prompt flags (--prompt-input-tokens-mean, --num-dataset-entries, --random-seed) with no --input-file and no public-dataset selector, so the dataset holds only generated text and the media-URL map stays empty. The same gating keeps dataset/loader/base_public_dataset.py, which fetches remote dataset archives over AioHttpClient, out of the run. Residual risk if a cluster-internal inference server were somehow made to emit malformed chunked framing is bounded: the flaw is an out-of-bounds read with no write primitive, and the process that would crash is a single-shot benchmark Job pod -- BackoffLimit 0, RestartPolicy Never, TTLSecondsAfterFinished 3600 in buildAIPerfJob -- running as non-root nvs (uid 1000) on a distroless base with no shell and no package manager. The outcome is a failed inference-perf validation, not a crossed security boundary."
    }
  ]
}