{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://quench-works.com/vex/calico-node/2026-10-08",
  "author": "QuenchWorks <info@quench-works.com>",
  "timestamp": "2026-10-08T00:00:00Z",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "CVE-2026-54332"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-54345"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-65819"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module github.com/gopacket/gopacket linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if github.com/gopacket/gopacket is below v1.6.1; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable github.com/gopacket/gopacket code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-84303"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-84304"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-84445"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module google.golang.org/grpc linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if google.golang.org/grpc is below v1.83.2; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable google.golang.org/grpc code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    },
    {
      "vulnerability": {
        "name": "CVE-2026-81870"
      },
      "products": [
        {
          "@id": "pkg:apk/wolfi/calico-node-3.32"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "PROVEN false-positive, measured 2026-10-08 on calico-node 3.32.0. The advisory is Wolfi's, keyed to the package calico-node-3.32 3.32.0-r4 (fixed in 3.32.2-r3, a revision not in the public APKINDEX on 2026-10-08), and its vulnerable code is the Go module go.opentelemetry.io/otel/exporters/otlp/otlptrace linked into that package's Go binaries. Listing every ELF file of calico-node-3.32-3.32.0-r4.apk and checking each for Go build info showed exactly two Go binaries, /usr/bin/calico-node and /usr/bin/mountns; the rest are the C BIRD daemons and BPF objects in /usr/lib/calico/bpf. This image replaces both binaries with quench-calico-node (melange `replaces: calico-node-3.32`), built from the v3.32.0 tag with the floor pass. Verified by the build itself: melange.yaml runs `go version -m` on both replacement binaries and fails if go.opentelemetry.io/otel/exporters/otlp/otlptrace is below v1.45.0; and the gate's binary scan of /usr/bin/calico-node (run 37707336807) reported none of these advisories, only cel-go, since floored. The vulnerable go.opentelemetry.io/otel/exporters/otlp/otlptrace code is therefore not present in the image; only the package record of the replaced apk still carries the version."
    }
  ]
}