{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://langgenius.ai/vex/dify-ee-uv-vendored",
  "author": "Dify Security <security@dify.ai>",
  "timestamp": "2026-10-09T00:00:00Z",
  "version": 2,
  "statements": [
    {
      "vulnerability": {
        "name": "sonatype-2026-003895",
        "aliases": [
          "GHSA-qwgh-2vcv-g2f7"
        ]
      },
      "products": [
        {
          "@id": "pkg:docker/langgenius/dify-ee-plugin-daemon-local",
          "subcomponents": [
            {
              "@id": "pkg:cargo/block-buffer@0.10.4"
            }
          ]
        },
        {
          "@id": "pkg:docker/langgenius/dify-ee-plugin-build-base-python-3.12",
          "subcomponents": [
            {
              "@id": "pkg:cargo/block-buffer@0.10.4"
            }
          ]
        },
        {
          "@id": "pkg:docker/langgenius/dify-ee-plugin-build-base-python-3.13",
          "subcomponents": [
            {
              "@id": "pkg:cargo/block-buffer@0.10.4"
            }
          ]
        },
        {
          "@id": "pkg:docker/langgenius/dify-ee-plugin-build-base-python-3.14",
          "subcomponents": [
            {
              "@id": "pkg:cargo/block-buffer@0.10.4"
            }
          ]
        }
      ],
      "status": "not_affected",
      "justification": "inline_mitigations_already_exist",
      "impact_statement": "block-buffer 0.10.4 is statically linked into the uv binary (Wolfi package uv-0.12.24-r0), which these images use at runtime to install plugin dependencies. The advisory requires a panic inside the buffer to be caught (via unwinding) and the corrupted buffer to be used again afterwards. uv's release profile is built with panic = \"abort\", so any panic terminates the process immediately and cannot be caught; the vulnerable state is unreachable. uv is no longer shipped in the API, API-insecure and sandbox images."
    }
  ]
}