{ "x402Version": 2, "id": 30546, "slug": "30546", "resource": "https://dependency-risk.use.x402atlas.com/batch", "description": "Batch dependency vulnerability check — check ordered exact package versions in OSV with deduplicated CVE enrichment, explicit completeness, and CISA KEV known-exploited signals.", "type": "http", "serviceName": "Open Source Vulnerability Check", "resourceType": "Identity & Enrichment", "accepts": [ { "scheme": "exact", "network": "eip155:8453", "payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2", "asset": "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 }, { "scheme": "exact", "network": "eip155:137", "payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2", "asset": "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 }, { "scheme": "exact", "network": "eip155:42161", "payTo": "0x8C128f1Ee62Bb5e47867CfbAe2ad89be325Df1b2", "asset": "0xaf88d065e77c8cC2239327C5EDb3A432268e5831", "amount": "10000", "amountUsd": 0.01, "maxTimeoutSeconds": 300 } ], "outputSchema": { "properties": { "example": { "additionalProperties": false, "description": "Complete transactional Dependency Risk response, limited to the native budget reserved below the 512 KiB deployed wire ceiling", "properties": { "_atlas": { "additionalProperties": false, "description": "Atlas documentation and related-route metadata added after deployment", "properties": { "docs": { "description": "Documentation URL for this bridge", "format": "uri", "maxLength": 512, "type": "string" }, "related": { "description": "Bounded related Atlas routes", "items": { "additionalProperties": false, "description": "One related Atlas route", "properties": { "bridge": { "description": "Related bridge name", "maxLength": 64, "type": "string" }, "docs": { "description": "Related bridge documentation URL", "format": "uri", "maxLength": 512, "type": "string" }, "summary": { "description": "Short capability summary", "maxLength": 256, "type": "string" }, "url": { "description": "Related route URL", "format": "uri", "maxLength": 512, "type": "string" } }, "required": [ "bridge", "url", "docs", "summary" ], "type": "object" }, "maxItems": 3, "type": "array" } }, "required": [ "docs" ], "type": "object" }, "operation": { "const": "batch-check", "description": "Stable route operation identifier", "type": "string" }, "partial": { "description": "True only when at least one complete item succeeded and another detail lookup transiently failed", "type": "boolean" }, "results": { "description": "Complete or explicitly failed results in original caller input order, including duplicate positions; all items collectively reference at most eight distinct OSV IDs", "items": { "additionalProperties": false, "description": "One position-preserving package result", "oneOf": [ { "not": { "required": [ "error_code" ] }, "properties": { "status": { "description": "A complete named-source conclusion requires summary and omits error_code", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found" ] } }, "required": [ "summary" ] }, { "not": { "required": [ "summary" ] }, "properties": { "status": { "const": "query_failed", "description": "An incomplete upstream result requires error_code and omits summary so it cannot resemble a risk conclusion" } }, "required": [ "error_code" ] } ], "properties": { "error_code": { "const": "upstream_error", "description": "Generic non-sensitive code present only when status is query_failed", "type": "string" }, "findings": { "description": "Complete findings for this exact input; collectively all response items reference at most eight distinct OSV IDs; always [] for no_known_vulnerabilities or query_failed", "items": { "additionalProperties": false, "description": "One complete normalized OSV vulnerability finding, limited to 48 KiB after JSON encoding, with optional exact CISA KEV enrichment", "properties": { "affected": { "description": "Bounded OSV affected package/range/event data in source order", "items": { "additionalProperties": false, "description": "One OSV affected package entry retained in source order", "properties": { "package": { "additionalProperties": false, "description": "Exact affected package identity published by OSV", "properties": { "ecosystem": { "description": "Exact OSV ecosystem identifier", "type": "string" }, "name": { "description": "Exact package name published by OSV", "type": "string" }, "purl": { "description": "Package URL published by OSV when supplied", "type": "string" } }, "type": "object" }, "ranges": { "description": "Affected ranges retained in OSV source order", "items": { "additionalProperties": false, "description": "One affected version range published by OSV", "properties": { "events": { "description": "Ordered OSV range events; the bridge does not infer ecosystem version ordering", "items": { "additionalProperties": false, "description": "One OSV range event; exactly one event field is normally supplied by the source", "properties": { "fixed": { "description": "OSV range event explicitly marking a fixed version", "type": "string" }, "introduced": { "description": "OSV range event marking an introduced version", "type": "string" }, "last_affected": { "description": "OSV range event marking the last affected version", "type": "string" }, "limit": { "description": "OSV range event upper limit when supplied", "type": "string" } }, "type": "object" }, "type": "array" }, "repo": { "description": "Repository identifier published by OSV for a GIT range", "type": "string" }, "type": { "description": "OSV range type such as SEMVER, ECOSYSTEM, or GIT", "type": "string" } }, "required": [ "type", "events" ], "type": "object" }, "type": "array" }, "severity": { "description": "Severity vectors attached to this affected package entry", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "type": "array" }, "versions": { "description": "Affected versions explicitly enumerated by OSV", "items": { "type": "string" }, "type": "array" } }, "required": [ "package", "ranges", "versions", "severity" ], "type": "object" }, "type": "array" }, "aliases": { "description": "Deduplicated lexical aliases published by OSV", "items": { "type": "string" }, "type": "array" }, "fixed_versions": { "description": "Only explicit fixed events for the matching package, deduplicated in OSV source order; [] means OSV supplied no fixed event, not that no fix exists", "items": { "type": "string" }, "type": "array" }, "id": { "description": "Authoritative OSV record identifier", "type": "string" }, "kev": { "additionalProperties": false, "description": "Exact CISA KEV match on a syntactically valid CVE ID or alias; omitted rather than null when no exact match exists", "properties": { "cve_id": { "description": "Exact CVE identifier matched in the CISA KEV catalog", "type": "string" }, "cwes": { "description": "CWE identifiers published by CISA", "items": { "type": "string" }, "type": "array" }, "date_added": { "description": "Date CISA added the CVE to KEV", "type": "string" }, "due_date": { "description": "CISA KEV due date for covered federal agencies", "type": "string" }, "known_ransomware_campaign_use": { "description": "CISA's published ransomware-campaign-use value when supplied", "type": "string" }, "notes": { "description": "Additional CISA KEV notes when supplied", "type": "string" }, "product": { "description": "Affected product label published by CISA", "type": "string" }, "required_action": { "description": "Required action text published by CISA; caller remediation review is still required", "type": "string" }, "short_description": { "description": "Short vulnerability description published by CISA", "type": "string" }, "vendor_project": { "description": "Vendor or project label published by CISA", "type": "string" }, "vulnerability_name": { "description": "CISA KEV vulnerability name", "type": "string" } }, "required": [ "cve_id", "vendor_project", "product", "vulnerability_name", "date_added", "short_description", "required_action", "due_date", "cwes" ], "type": "object" }, "max_severity": { "description": "Highest severity derived only from a parseable declared CVSS vector", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" }, "modified": { "description": "OSV modification time string", "type": "string" }, "published": { "description": "OSV publication time string when supplied", "type": "string" }, "references": { "description": "Bounded references published by OSV; URLs are untrusted data returned for provenance and are never fetched by this bridge", "items": { "additionalProperties": false, "description": "One OSV-published reference retained as provenance data", "properties": { "type": { "description": "OSV reference classification such as ADVISORY, FIX, REPORT, or WEB", "type": "string" }, "url": { "description": "Reference URL supplied by OSV as untrusted provenance data; never fetched by this bridge", "type": "string" } }, "required": [ "type", "url" ], "type": "object" }, "type": "array" }, "severity": { "description": "At most 16 published top-level OSV severity vectors", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "maxItems": 16, "type": "array" }, "summary": { "description": "Bounded OSV summary", "type": "string" }, "withdrawn": { "description": "Whether OSV withdrew the record; withdrawn findings remain visible but do not count in the active summary", "type": "boolean" }, "withdrawn_at": { "description": "OSV withdrawal time string, present only when supplied", "type": "string" } }, "required": [ "id", "aliases", "modified", "withdrawn", "affected", "references", "severity", "max_severity", "fixed_versions" ], "type": "object" }, "maxItems": 8, "type": "array" }, "input": { "additionalProperties": false, "description": "Canonical exact package/version identity", "properties": { "ecosystem": { "description": "Exact package ecosystem; purl types remain canonical lowercase identifiers", "type": "string" }, "name": { "description": "Exact package-manager name", "type": "string" }, "purl": { "description": "Canonical input purl when the caller used purl form; otherwise omitted", "type": "string" }, "version": { "description": "Exact queried package version", "type": "string" } }, "required": [ "ecosystem", "name", "version" ], "type": "object" }, "status": { "description": "Named-source conclusion: query_failed is explicit incompleteness and never a clean result", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found", "query_failed" ], "type": "string" }, "summary": { "additionalProperties": false, "description": "Summary of active non-withdrawn findings", "properties": { "finding_count": { "description": "Active non-withdrawn finding count", "maximum": 8, "minimum": 0, "type": "integer" }, "kev_count": { "description": "Active findings with an exact KEV CVE match", "maximum": 8, "minimum": 0, "type": "integer" }, "max_severity": { "description": "Highest parseable published CVSS severity among active findings", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" } }, "required": [ "finding_count", "kev_count", "max_severity" ], "type": "object" } }, "required": [ "input", "status", "findings" ], "type": "object" }, "maxItems": 50, "type": "array" }, "retrieved_at": { "description": "UTC time this bridge completed the response; this is not an OSV publication or modification time", "format": "date-time", "type": "string" }, "schema_version": { "const": "dependency-risk-v1", "description": "Version of the normalized Dependency Risk response contract", "type": "string" }, "source": { "additionalProperties": false, "description": "Named public sources and the exact CISA KEV snapshot used for this response", "properties": { "cisa_kev": { "additionalProperties": false, "description": "Validated CISA Known Exploited Vulnerabilities snapshot used for exact CVE enrichment", "properties": { "catalog_version": { "description": "Catalog version published in the validated CISA feed", "type": "string" }, "date_released": { "description": "Release time published in the validated CISA feed", "type": "string" }, "name": { "const": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog", "description": "Official CISA KEV source name", "type": "string" }, "retrieved_at": { "description": "UTC time this exact validated KEV snapshot was retrieved", "format": "date-time", "type": "string" } }, "required": [ "name", "catalog_version", "date_released", "retrieved_at" ], "type": "object" }, "osv": { "additionalProperties": false, "description": "OSV source identity; individual finding times carry record publication and modification semantics", "properties": { "name": { "const": "OSV.dev", "description": "Official OSV.dev vulnerability record aggregator", "type": "string" } }, "required": [ "name" ], "type": "object" } }, "required": [ "osv", "cisa_kev" ], "type": "object" }, "stale": { "description": "True only when a prior validated CISA KEV snapshot is served after refresh failure; OSV result completeness is never silently marked stale", "type": "boolean" }, "warnings": { "description": "Freshness and interpretation warnings; always [] when none", "items": { "description": "Bounded warning intended for caller action or interpretation", "type": "string" }, "type": "array" } }, "required": [ "operation", "schema_version", "source", "retrieved_at", "stale", "warnings", "results", "partial" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" }, "extensions": { "bazaar": { "category": "security", "info": { "input": { "body": { "packages": [ { "purl": "pkg:golang/golang.org/x/text@v0.3.7" }, { "purl": "pkg:golang/golang.org/x/text@v0.3.7" } ] }, "bodyType": "json", "method": "POST", "type": "http" }, "output": { "example": { "operation": "batch-check", "partial": false, "results": [ { "findings": [ { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GO-2022-1059" ], "fixed_versions": [ "0.3.8" ], "id": "GHSA-69ch-w2m2-3vjp", "max_severity": "high", "modified": "2026-02-04T03:11:34.199431Z", "published": "2022-10-14T19:00:40Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149" }, { "type": "WEB", "url": "https://github.com/golang/go/issues/56152" }, { "type": "WEB", "url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c" }, { "type": "PACKAGE", "url": "https://github.com/golang/text" }, { "type": "WEB", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://go.dev/issue/56152" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2022-1059" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230203-0006" } ], "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GHSA-69ch-w2m2-3vjp" ], "fixed_versions": [ "0.3.8" ], "id": "GO-2022-1059", "max_severity": "unknown", "modified": "2026-02-04T03:39:03.311488Z", "published": "2022-10-11T18:16:24Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/56152" }, { "type": "FIX", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" } ], "severity": [], "summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.39.0" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2026-56852" ], "fixed_versions": [ "0.39.0" ], "id": "GO-2026-5970", "max_severity": "unknown", "modified": "2026-07-22T20:59:36.034292423Z", "published": "2026-07-14T17:29:56Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/80142" }, { "type": "FIX", "url": "https://go.dev/cl/794100" } ], "severity": [], "summary": "Infinite loop on invalid input in golang.org/x/text", "withdrawn": false } ], "input": { "ecosystem": "golang", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.3.7", "version": "v0.3.7" }, "status": "vulnerabilities_found", "summary": { "finding_count": 3, "kev_count": 0, "max_severity": "high" } }, { "findings": [ { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GO-2022-1059" ], "fixed_versions": [ "0.3.8" ], "id": "GHSA-69ch-w2m2-3vjp", "max_severity": "high", "modified": "2026-02-04T03:11:34.199431Z", "published": "2022-10-14T19:00:40Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149" }, { "type": "WEB", "url": "https://github.com/golang/go/issues/56152" }, { "type": "WEB", "url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c" }, { "type": "PACKAGE", "url": "https://github.com/golang/text" }, { "type": "WEB", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://go.dev/issue/56152" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2022-1059" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230203-0006" } ], "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GHSA-69ch-w2m2-3vjp" ], "fixed_versions": [ "0.3.8" ], "id": "GO-2022-1059", "max_severity": "unknown", "modified": "2026-02-04T03:39:03.311488Z", "published": "2022-10-11T18:16:24Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/56152" }, { "type": "FIX", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" } ], "severity": [], "summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.39.0" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2026-56852" ], "fixed_versions": [ "0.39.0" ], "id": "GO-2026-5970", "max_severity": "unknown", "modified": "2026-07-22T20:59:36.034292423Z", "published": "2026-07-14T17:29:56Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/80142" }, { "type": "FIX", "url": "https://go.dev/cl/794100" } ], "severity": [], "summary": "Infinite loop on invalid input in golang.org/x/text", "withdrawn": false } ], "input": { "ecosystem": "golang", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.3.7", "version": "v0.3.7" }, "status": "vulnerabilities_found", "summary": { "finding_count": 3, "kev_count": 0, "max_severity": "high" } } ], "retrieved_at": "2026-08-02T00:00:00Z", "schema_version": "dependency-risk-v1", "source": { "cisa_kev": { "catalog_version": "2026.07.29", "date_released": "2026-07-29T18:45:59.5809Z", "name": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog", "retrieved_at": "2026-08-02T00:00:00Z" }, "osv": { "name": "OSV.dev" } }, "stale": false, "warnings": [] }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "body": { "additionalProperties": false, "properties": { "packages": { "description": "Ordered exact package versions; duplicates preserve positions and share source work. The complete OSV result must contain no page token and at most eight distinct vulnerability IDs for V1 enrichment.", "items": { "additionalProperties": false, "description": "One exact package version using exactly one accepted identifier form", "oneOf": [ { "not": { "anyOf": [ { "required": [ "package" ] }, { "required": [ "version" ] } ] }, "required": [ "purl" ] }, { "not": { "required": [ "purl" ] }, "required": [ "package", "version" ] } ], "properties": { "package": { "additionalProperties": false, "description": "Exact OSV package identity; use with version", "properties": { "ecosystem": { "description": "Exact OSV ecosystem identifier, up to 64 UTF-8 bytes", "maxLength": 64, "minLength": 1, "type": "string" }, "name": { "description": "Exact package-manager name, up to 512 UTF-8 bytes", "maxLength": 512, "minLength": 1, "type": "string" } }, "required": [ "ecosystem", "name" ], "type": "object" }, "purl": { "description": "Canonical package URL with embedded exact version; mutually exclusive with package and version", "maxLength": 2048, "minLength": 1, "type": "string" }, "version": { "description": "Exact version used with package, up to 256 UTF-8 bytes", "maxLength": 256, "minLength": 1, "type": "string" } }, "type": "object" }, "maxItems": 50, "minItems": 1, "type": "array" } }, "required": [ "packages" ], "type": "object" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" }, "method": { "enum": [ "POST" ], "type": "string" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method", "bodyType", "body" ], "type": "object" }, "output": { "properties": { "example": { "additionalProperties": false, "description": "Complete transactional Dependency Risk response, limited to the native budget reserved below the 512 KiB deployed wire ceiling", "properties": { "_atlas": { "additionalProperties": false, "description": "Atlas documentation and related-route metadata added after deployment", "properties": { "docs": { "description": "Documentation URL for this bridge", "format": "uri", "maxLength": 512, "type": "string" }, "related": { "description": "Bounded related Atlas routes", "items": { "additionalProperties": false, "description": "One related Atlas route", "properties": { "bridge": { "description": "Related bridge name", "maxLength": 64, "type": "string" }, "docs": { "description": "Related bridge documentation URL", "format": "uri", "maxLength": 512, "type": "string" }, "summary": { "description": "Short capability summary", "maxLength": 256, "type": "string" }, "url": { "description": "Related route URL", "format": "uri", "maxLength": 512, "type": "string" } }, "required": [ "bridge", "url", "docs", "summary" ], "type": "object" }, "maxItems": 3, "type": "array" } }, "required": [ "docs" ], "type": "object" }, "operation": { "const": "batch-check", "description": "Stable route operation identifier", "type": "string" }, "partial": { "description": "True only when at least one complete item succeeded and another detail lookup transiently failed", "type": "boolean" }, "results": { "description": "Complete or explicitly failed results in original caller input order, including duplicate positions; all items collectively reference at most eight distinct OSV IDs", "items": { "additionalProperties": false, "description": "One position-preserving package result", "oneOf": [ { "not": { "required": [ "error_code" ] }, "properties": { "status": { "description": "A complete named-source conclusion requires summary and omits error_code", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found" ] } }, "required": [ "summary" ] }, { "not": { "required": [ "summary" ] }, "properties": { "status": { "const": "query_failed", "description": "An incomplete upstream result requires error_code and omits summary so it cannot resemble a risk conclusion" } }, "required": [ "error_code" ] } ], "properties": { "error_code": { "const": "upstream_error", "description": "Generic non-sensitive code present only when status is query_failed", "type": "string" }, "findings": { "description": "Complete findings for this exact input; collectively all response items reference at most eight distinct OSV IDs; always [] for no_known_vulnerabilities or query_failed", "items": { "additionalProperties": false, "description": "One complete normalized OSV vulnerability finding, limited to 48 KiB after JSON encoding, with optional exact CISA KEV enrichment", "properties": { "affected": { "description": "Bounded OSV affected package/range/event data in source order", "items": { "additionalProperties": false, "description": "One OSV affected package entry retained in source order", "properties": { "package": { "additionalProperties": false, "description": "Exact affected package identity published by OSV", "properties": { "ecosystem": { "description": "Exact OSV ecosystem identifier", "type": "string" }, "name": { "description": "Exact package name published by OSV", "type": "string" }, "purl": { "description": "Package URL published by OSV when supplied", "type": "string" } }, "type": "object" }, "ranges": { "description": "Affected ranges retained in OSV source order", "items": { "additionalProperties": false, "description": "One affected version range published by OSV", "properties": { "events": { "description": "Ordered OSV range events; the bridge does not infer ecosystem version ordering", "items": { "additionalProperties": false, "description": "One OSV range event; exactly one event field is normally supplied by the source", "properties": { "fixed": { "description": "OSV range event explicitly marking a fixed version", "type": "string" }, "introduced": { "description": "OSV range event marking an introduced version", "type": "string" }, "last_affected": { "description": "OSV range event marking the last affected version", "type": "string" }, "limit": { "description": "OSV range event upper limit when supplied", "type": "string" } }, "type": "object" }, "type": "array" }, "repo": { "description": "Repository identifier published by OSV for a GIT range", "type": "string" }, "type": { "description": "OSV range type such as SEMVER, ECOSYSTEM, or GIT", "type": "string" } }, "required": [ "type", "events" ], "type": "object" }, "type": "array" }, "severity": { "description": "Severity vectors attached to this affected package entry", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "type": "array" }, "versions": { "description": "Affected versions explicitly enumerated by OSV", "items": { "type": "string" }, "type": "array" } }, "required": [ "package", "ranges", "versions", "severity" ], "type": "object" }, "type": "array" }, "aliases": { "description": "Deduplicated lexical aliases published by OSV", "items": { "type": "string" }, "type": "array" }, "fixed_versions": { "description": "Only explicit fixed events for the matching package, deduplicated in OSV source order; [] means OSV supplied no fixed event, not that no fix exists", "items": { "type": "string" }, "type": "array" }, "id": { "description": "Authoritative OSV record identifier", "type": "string" }, "kev": { "additionalProperties": false, "description": "Exact CISA KEV match on a syntactically valid CVE ID or alias; omitted rather than null when no exact match exists", "properties": { "cve_id": { "description": "Exact CVE identifier matched in the CISA KEV catalog", "type": "string" }, "cwes": { "description": "CWE identifiers published by CISA", "items": { "type": "string" }, "type": "array" }, "date_added": { "description": "Date CISA added the CVE to KEV", "type": "string" }, "due_date": { "description": "CISA KEV due date for covered federal agencies", "type": "string" }, "known_ransomware_campaign_use": { "description": "CISA's published ransomware-campaign-use value when supplied", "type": "string" }, "notes": { "description": "Additional CISA KEV notes when supplied", "type": "string" }, "product": { "description": "Affected product label published by CISA", "type": "string" }, "required_action": { "description": "Required action text published by CISA; caller remediation review is still required", "type": "string" }, "short_description": { "description": "Short vulnerability description published by CISA", "type": "string" }, "vendor_project": { "description": "Vendor or project label published by CISA", "type": "string" }, "vulnerability_name": { "description": "CISA KEV vulnerability name", "type": "string" } }, "required": [ "cve_id", "vendor_project", "product", "vulnerability_name", "date_added", "short_description", "required_action", "due_date", "cwes" ], "type": "object" }, "max_severity": { "description": "Highest severity derived only from a parseable declared CVSS vector", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" }, "modified": { "description": "OSV modification time string", "type": "string" }, "published": { "description": "OSV publication time string when supplied", "type": "string" }, "references": { "description": "Bounded references published by OSV; URLs are untrusted data returned for provenance and are never fetched by this bridge", "items": { "additionalProperties": false, "description": "One OSV-published reference retained as provenance data", "properties": { "type": { "description": "OSV reference classification such as ADVISORY, FIX, REPORT, or WEB", "type": "string" }, "url": { "description": "Reference URL supplied by OSV as untrusted provenance data; never fetched by this bridge", "type": "string" } }, "required": [ "type", "url" ], "type": "object" }, "type": "array" }, "severity": { "description": "At most 16 published top-level OSV severity vectors", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "maxItems": 16, "type": "array" }, "summary": { "description": "Bounded OSV summary", "type": "string" }, "withdrawn": { "description": "Whether OSV withdrew the record; withdrawn findings remain visible but do not count in the active summary", "type": "boolean" }, "withdrawn_at": { "description": "OSV withdrawal time string, present only when supplied", "type": "string" } }, "required": [ "id", "aliases", "modified", "withdrawn", "affected", "references", "severity", "max_severity", "fixed_versions" ], "type": "object" }, "maxItems": 8, "type": "array" }, "input": { "additionalProperties": false, "description": "Canonical exact package/version identity", "properties": { "ecosystem": { "description": "Exact package ecosystem; purl types remain canonical lowercase identifiers", "type": "string" }, "name": { "description": "Exact package-manager name", "type": "string" }, "purl": { "description": "Canonical input purl when the caller used purl form; otherwise omitted", "type": "string" }, "version": { "description": "Exact queried package version", "type": "string" } }, "required": [ "ecosystem", "name", "version" ], "type": "object" }, "status": { "description": "Named-source conclusion: query_failed is explicit incompleteness and never a clean result", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found", "query_failed" ], "type": "string" }, "summary": { "additionalProperties": false, "description": "Summary of active non-withdrawn findings", "properties": { "finding_count": { "description": "Active non-withdrawn finding count", "maximum": 8, "minimum": 0, "type": "integer" }, "kev_count": { "description": "Active findings with an exact KEV CVE match", "maximum": 8, "minimum": 0, "type": "integer" }, "max_severity": { "description": "Highest parseable published CVSS severity among active findings", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" } }, "required": [ "finding_count", "kev_count", "max_severity" ], "type": "object" } }, "required": [ "input", "status", "findings" ], "type": "object" }, "maxItems": 50, "type": "array" }, "retrieved_at": { "description": "UTC time this bridge completed the response; this is not an OSV publication or modification time", "format": "date-time", "type": "string" }, "schema_version": { "const": "dependency-risk-v1", "description": "Version of the normalized Dependency Risk response contract", "type": "string" }, "source": { "additionalProperties": false, "description": "Named public sources and the exact CISA KEV snapshot used for this response", "properties": { "cisa_kev": { "additionalProperties": false, "description": "Validated CISA Known Exploited Vulnerabilities snapshot used for exact CVE enrichment", "properties": { "catalog_version": { "description": "Catalog version published in the validated CISA feed", "type": "string" }, "date_released": { "description": "Release time published in the validated CISA feed", "type": "string" }, "name": { "const": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog", "description": "Official CISA KEV source name", "type": "string" }, "retrieved_at": { "description": "UTC time this exact validated KEV snapshot was retrieved", "format": "date-time", "type": "string" } }, "required": [ "name", "catalog_version", "date_released", "retrieved_at" ], "type": "object" }, "osv": { "additionalProperties": false, "description": "OSV source identity; individual finding times carry record publication and modification semantics", "properties": { "name": { "const": "OSV.dev", "description": "Official OSV.dev vulnerability record aggregator", "type": "string" } }, "required": [ "name" ], "type": "object" } }, "required": [ "osv", "cisa_kev" ], "type": "object" }, "stale": { "description": "True only when a prior validated CISA KEV snapshot is served after refresh failure; OSV result completeness is never silently marked stale", "type": "boolean" }, "warnings": { "description": "Freshness and interpretation warnings; always [] when none", "items": { "description": "Bounded warning intended for caller action or interpretation", "type": "string" }, "type": "array" } }, "required": [ "operation", "schema_version", "source", "retrieved_at", "stale", "warnings", "results", "partial" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" }, "tags": [ "batch-vulnerability-check", "osv", "cve", "cisa-kev", "software-supply-chain" ] } }, "tags": [ "batch-vulnerability-check", "osv", "cve", "cisa-kev", "software-supply-chain", "bazaar" ], "sourceHost": "dependency-risk.use.x402atlas.com", "lastUpdated": "2026-10-01T06:32:23.684Z", "quality": { "calls30d": 3, "uniquePayers30d": 2, "lastCalledAt": "2026-10-01T06:32:20.782Z" }, "metadata": { "serviceName": "Open Source Vulnerability Check", "extensions": { "bazaar": { "category": "security", "info": { "input": { "body": { "packages": [ { "purl": "pkg:golang/golang.org/x/text@v0.3.7" }, { "purl": "pkg:golang/golang.org/x/text@v0.3.7" } ] }, "bodyType": "json", "method": "POST", "type": "http" }, "output": { "example": { "operation": "batch-check", "partial": false, "results": [ { "findings": [ { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GO-2022-1059" ], "fixed_versions": [ "0.3.8" ], "id": "GHSA-69ch-w2m2-3vjp", "max_severity": "high", "modified": "2026-02-04T03:11:34.199431Z", "published": "2022-10-14T19:00:40Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149" }, { "type": "WEB", "url": "https://github.com/golang/go/issues/56152" }, { "type": "WEB", "url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c" }, { "type": "PACKAGE", "url": "https://github.com/golang/text" }, { "type": "WEB", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://go.dev/issue/56152" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2022-1059" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230203-0006" } ], "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GHSA-69ch-w2m2-3vjp" ], "fixed_versions": [ "0.3.8" ], "id": "GO-2022-1059", "max_severity": "unknown", "modified": "2026-02-04T03:39:03.311488Z", "published": "2022-10-11T18:16:24Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/56152" }, { "type": "FIX", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" } ], "severity": [], "summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.39.0" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2026-56852" ], "fixed_versions": [ "0.39.0" ], "id": "GO-2026-5970", "max_severity": "unknown", "modified": "2026-07-22T20:59:36.034292423Z", "published": "2026-07-14T17:29:56Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/80142" }, { "type": "FIX", "url": "https://go.dev/cl/794100" } ], "severity": [], "summary": "Infinite loop on invalid input in golang.org/x/text", "withdrawn": false } ], "input": { "ecosystem": "golang", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.3.7", "version": "v0.3.7" }, "status": "vulnerabilities_found", "summary": { "finding_count": 3, "kev_count": 0, "max_severity": "high" } }, { "findings": [ { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GO-2022-1059" ], "fixed_versions": [ "0.3.8" ], "id": "GHSA-69ch-w2m2-3vjp", "max_severity": "high", "modified": "2026-02-04T03:11:34.199431Z", "published": "2022-10-14T19:00:40Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-32149" }, { "type": "WEB", "url": "https://github.com/golang/go/issues/56152" }, { "type": "WEB", "url": "https://github.com/golang/text/commit/434eadcdbc3b0256971992e8c70027278364c72c" }, { "type": "PACKAGE", "url": "https://github.com/golang/text" }, { "type": "WEB", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://go.dev/issue/56152" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" }, { "type": "WEB", "url": "https://pkg.go.dev/vuln/GO-2022-1059" }, { "type": "WEB", "url": "https://security.netapp.com/advisory/ntap-20230203-0006" } ], "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "type": "CVSS_V3" } ], "summary": "golang.org/x/text/language Denial of service via crafted Accept-Language header", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.3.8" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2022-32149", "GHSA-69ch-w2m2-3vjp" ], "fixed_versions": [ "0.3.8" ], "id": "GO-2022-1059", "max_severity": "unknown", "modified": "2026-02-04T03:39:03.311488Z", "published": "2022-10-11T18:16:24Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/56152" }, { "type": "FIX", "url": "https://go.dev/cl/442235" }, { "type": "WEB", "url": "https://groups.google.com/g/golang-announce/c/-hjNw559_tE/m/KlGTfid5CAAJ" } ], "severity": [], "summary": "Denial of service via crafted Accept-Language header in golang.org/x/text/language", "withdrawn": false }, { "affected": [ { "package": { "ecosystem": "Go", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "0.39.0" } ], "type": "SEMVER" } ], "severity": [], "versions": [] } ], "aliases": [ "CVE-2026-56852" ], "fixed_versions": [ "0.39.0" ], "id": "GO-2026-5970", "max_severity": "unknown", "modified": "2026-07-22T20:59:36.034292423Z", "published": "2026-07-14T17:29:56Z", "references": [ { "type": "REPORT", "url": "https://go.dev/issue/80142" }, { "type": "FIX", "url": "https://go.dev/cl/794100" } ], "severity": [], "summary": "Infinite loop on invalid input in golang.org/x/text", "withdrawn": false } ], "input": { "ecosystem": "golang", "name": "golang.org/x/text", "purl": "pkg:golang/golang.org/x/text@v0.3.7", "version": "v0.3.7" }, "status": "vulnerabilities_found", "summary": { "finding_count": 3, "kev_count": 0, "max_severity": "high" } } ], "retrieved_at": "2026-08-02T00:00:00Z", "schema_version": "dependency-risk-v1", "source": { "cisa_kev": { "catalog_version": "2026.07.29", "date_released": "2026-07-29T18:45:59.5809Z", "name": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog", "retrieved_at": "2026-08-02T00:00:00Z" }, "osv": { "name": "OSV.dev" } }, "stale": false, "warnings": [] }, "type": "json" } }, "schema": { "$schema": "https://json-schema.org/draft/2020-12/schema", "properties": { "input": { "additionalProperties": false, "properties": { "body": { "additionalProperties": false, "properties": { "packages": { "description": "Ordered exact package versions; duplicates preserve positions and share source work. The complete OSV result must contain no page token and at most eight distinct vulnerability IDs for V1 enrichment.", "items": { "additionalProperties": false, "description": "One exact package version using exactly one accepted identifier form", "oneOf": [ { "not": { "anyOf": [ { "required": [ "package" ] }, { "required": [ "version" ] } ] }, "required": [ "purl" ] }, { "not": { "required": [ "purl" ] }, "required": [ "package", "version" ] } ], "properties": { "package": { "additionalProperties": false, "description": "Exact OSV package identity; use with version", "properties": { "ecosystem": { "description": "Exact OSV ecosystem identifier, up to 64 UTF-8 bytes", "maxLength": 64, "minLength": 1, "type": "string" }, "name": { "description": "Exact package-manager name, up to 512 UTF-8 bytes", "maxLength": 512, "minLength": 1, "type": "string" } }, "required": [ "ecosystem", "name" ], "type": "object" }, "purl": { "description": "Canonical package URL with embedded exact version; mutually exclusive with package and version", "maxLength": 2048, "minLength": 1, "type": "string" }, "version": { "description": "Exact version used with package, up to 256 UTF-8 bytes", "maxLength": 256, "minLength": 1, "type": "string" } }, "type": "object" }, "maxItems": 50, "minItems": 1, "type": "array" } }, "required": [ "packages" ], "type": "object" }, "bodyType": { "enum": [ "json", "form-data", "text" ], "type": "string" }, "method": { "enum": [ "POST" ], "type": "string" }, "type": { "const": "http", "type": "string" } }, "required": [ "type", "method", "bodyType", "body" ], "type": "object" }, "output": { "properties": { "example": { "additionalProperties": false, "description": "Complete transactional Dependency Risk response, limited to the native budget reserved below the 512 KiB deployed wire ceiling", "properties": { "_atlas": { "additionalProperties": false, "description": "Atlas documentation and related-route metadata added after deployment", "properties": { "docs": { "description": "Documentation URL for this bridge", "format": "uri", "maxLength": 512, "type": "string" }, "related": { "description": "Bounded related Atlas routes", "items": { "additionalProperties": false, "description": "One related Atlas route", "properties": { "bridge": { "description": "Related bridge name", "maxLength": 64, "type": "string" }, "docs": { "description": "Related bridge documentation URL", "format": "uri", "maxLength": 512, "type": "string" }, "summary": { "description": "Short capability summary", "maxLength": 256, "type": "string" }, "url": { "description": "Related route URL", "format": "uri", "maxLength": 512, "type": "string" } }, "required": [ "bridge", "url", "docs", "summary" ], "type": "object" }, "maxItems": 3, "type": "array" } }, "required": [ "docs" ], "type": "object" }, "operation": { "const": "batch-check", "description": "Stable route operation identifier", "type": "string" }, "partial": { "description": "True only when at least one complete item succeeded and another detail lookup transiently failed", "type": "boolean" }, "results": { "description": "Complete or explicitly failed results in original caller input order, including duplicate positions; all items collectively reference at most eight distinct OSV IDs", "items": { "additionalProperties": false, "description": "One position-preserving package result", "oneOf": [ { "not": { "required": [ "error_code" ] }, "properties": { "status": { "description": "A complete named-source conclusion requires summary and omits error_code", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found" ] } }, "required": [ "summary" ] }, { "not": { "required": [ "summary" ] }, "properties": { "status": { "const": "query_failed", "description": "An incomplete upstream result requires error_code and omits summary so it cannot resemble a risk conclusion" } }, "required": [ "error_code" ] } ], "properties": { "error_code": { "const": "upstream_error", "description": "Generic non-sensitive code present only when status is query_failed", "type": "string" }, "findings": { "description": "Complete findings for this exact input; collectively all response items reference at most eight distinct OSV IDs; always [] for no_known_vulnerabilities or query_failed", "items": { "additionalProperties": false, "description": "One complete normalized OSV vulnerability finding, limited to 48 KiB after JSON encoding, with optional exact CISA KEV enrichment", "properties": { "affected": { "description": "Bounded OSV affected package/range/event data in source order", "items": { "additionalProperties": false, "description": "One OSV affected package entry retained in source order", "properties": { "package": { "additionalProperties": false, "description": "Exact affected package identity published by OSV", "properties": { "ecosystem": { "description": "Exact OSV ecosystem identifier", "type": "string" }, "name": { "description": "Exact package name published by OSV", "type": "string" }, "purl": { "description": "Package URL published by OSV when supplied", "type": "string" } }, "type": "object" }, "ranges": { "description": "Affected ranges retained in OSV source order", "items": { "additionalProperties": false, "description": "One affected version range published by OSV", "properties": { "events": { "description": "Ordered OSV range events; the bridge does not infer ecosystem version ordering", "items": { "additionalProperties": false, "description": "One OSV range event; exactly one event field is normally supplied by the source", "properties": { "fixed": { "description": "OSV range event explicitly marking a fixed version", "type": "string" }, "introduced": { "description": "OSV range event marking an introduced version", "type": "string" }, "last_affected": { "description": "OSV range event marking the last affected version", "type": "string" }, "limit": { "description": "OSV range event upper limit when supplied", "type": "string" } }, "type": "object" }, "type": "array" }, "repo": { "description": "Repository identifier published by OSV for a GIT range", "type": "string" }, "type": { "description": "OSV range type such as SEMVER, ECOSYSTEM, or GIT", "type": "string" } }, "required": [ "type", "events" ], "type": "object" }, "type": "array" }, "severity": { "description": "Severity vectors attached to this affected package entry", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "type": "array" }, "versions": { "description": "Affected versions explicitly enumerated by OSV", "items": { "type": "string" }, "type": "array" } }, "required": [ "package", "ranges", "versions", "severity" ], "type": "object" }, "type": "array" }, "aliases": { "description": "Deduplicated lexical aliases published by OSV", "items": { "type": "string" }, "type": "array" }, "fixed_versions": { "description": "Only explicit fixed events for the matching package, deduplicated in OSV source order; [] means OSV supplied no fixed event, not that no fix exists", "items": { "type": "string" }, "type": "array" }, "id": { "description": "Authoritative OSV record identifier", "type": "string" }, "kev": { "additionalProperties": false, "description": "Exact CISA KEV match on a syntactically valid CVE ID or alias; omitted rather than null when no exact match exists", "properties": { "cve_id": { "description": "Exact CVE identifier matched in the CISA KEV catalog", "type": "string" }, "cwes": { "description": "CWE identifiers published by CISA", "items": { "type": "string" }, "type": "array" }, "date_added": { "description": "Date CISA added the CVE to KEV", "type": "string" }, "due_date": { "description": "CISA KEV due date for covered federal agencies", "type": "string" }, "known_ransomware_campaign_use": { "description": "CISA's published ransomware-campaign-use value when supplied", "type": "string" }, "notes": { "description": "Additional CISA KEV notes when supplied", "type": "string" }, "product": { "description": "Affected product label published by CISA", "type": "string" }, "required_action": { "description": "Required action text published by CISA; caller remediation review is still required", "type": "string" }, "short_description": { "description": "Short vulnerability description published by CISA", "type": "string" }, "vendor_project": { "description": "Vendor or project label published by CISA", "type": "string" }, "vulnerability_name": { "description": "CISA KEV vulnerability name", "type": "string" } }, "required": [ "cve_id", "vendor_project", "product", "vulnerability_name", "date_added", "short_description", "required_action", "due_date", "cwes" ], "type": "object" }, "max_severity": { "description": "Highest severity derived only from a parseable declared CVSS vector", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" }, "modified": { "description": "OSV modification time string", "type": "string" }, "published": { "description": "OSV publication time string when supplied", "type": "string" }, "references": { "description": "Bounded references published by OSV; URLs are untrusted data returned for provenance and are never fetched by this bridge", "items": { "additionalProperties": false, "description": "One OSV-published reference retained as provenance data", "properties": { "type": { "description": "OSV reference classification such as ADVISORY, FIX, REPORT, or WEB", "type": "string" }, "url": { "description": "Reference URL supplied by OSV as untrusted provenance data; never fetched by this bridge", "type": "string" } }, "required": [ "type", "url" ], "type": "object" }, "type": "array" }, "severity": { "description": "At most 16 published top-level OSV severity vectors", "items": { "additionalProperties": false, "description": "One severity vector exactly as published by OSV", "properties": { "score": { "description": "Original published vector; malformed or mismatched vectors are retained but score as unknown", "type": "string" }, "type": { "description": "OSV-declared score type such as CVSS_V3", "type": "string" } }, "required": [ "type", "score" ], "type": "object" }, "maxItems": 16, "type": "array" }, "summary": { "description": "Bounded OSV summary", "type": "string" }, "withdrawn": { "description": "Whether OSV withdrew the record; withdrawn findings remain visible but do not count in the active summary", "type": "boolean" }, "withdrawn_at": { "description": "OSV withdrawal time string, present only when supplied", "type": "string" } }, "required": [ "id", "aliases", "modified", "withdrawn", "affected", "references", "severity", "max_severity", "fixed_versions" ], "type": "object" }, "maxItems": 8, "type": "array" }, "input": { "additionalProperties": false, "description": "Canonical exact package/version identity", "properties": { "ecosystem": { "description": "Exact package ecosystem; purl types remain canonical lowercase identifiers", "type": "string" }, "name": { "description": "Exact package-manager name", "type": "string" }, "purl": { "description": "Canonical input purl when the caller used purl form; otherwise omitted", "type": "string" }, "version": { "description": "Exact queried package version", "type": "string" } }, "required": [ "ecosystem", "name", "version" ], "type": "object" }, "status": { "description": "Named-source conclusion: query_failed is explicit incompleteness and never a clean result", "enum": [ "no_known_vulnerabilities", "vulnerabilities_found", "query_failed" ], "type": "string" }, "summary": { "additionalProperties": false, "description": "Summary of active non-withdrawn findings", "properties": { "finding_count": { "description": "Active non-withdrawn finding count", "maximum": 8, "minimum": 0, "type": "integer" }, "kev_count": { "description": "Active findings with an exact KEV CVE match", "maximum": 8, "minimum": 0, "type": "integer" }, "max_severity": { "description": "Highest parseable published CVSS severity among active findings", "enum": [ "unknown", "low", "medium", "high", "critical" ], "type": "string" } }, "required": [ "finding_count", "kev_count", "max_severity" ], "type": "object" } }, "required": [ "input", "status", "findings" ], "type": "object" }, "maxItems": 50, "type": "array" }, "retrieved_at": { "description": "UTC time this bridge completed the response; this is not an OSV publication or modification time", "format": "date-time", "type": "string" }, "schema_version": { "const": "dependency-risk-v1", "description": "Version of the normalized Dependency Risk response contract", "type": "string" }, "source": { "additionalProperties": false, "description": "Named public sources and the exact CISA KEV snapshot used for this response", "properties": { "cisa_kev": { "additionalProperties": false, "description": "Validated CISA Known Exploited Vulnerabilities snapshot used for exact CVE enrichment", "properties": { "catalog_version": { "description": "Catalog version published in the validated CISA feed", "type": "string" }, "date_released": { "description": "Release time published in the validated CISA feed", "type": "string" }, "name": { "const": "Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities Catalog", "description": "Official CISA KEV source name", "type": "string" }, "retrieved_at": { "description": "UTC time this exact validated KEV snapshot was retrieved", "format": "date-time", "type": "string" } }, "required": [ "name", "catalog_version", "date_released", "retrieved_at" ], "type": "object" }, "osv": { "additionalProperties": false, "description": "OSV source identity; individual finding times carry record publication and modification semantics", "properties": { "name": { "const": "OSV.dev", "description": "Official OSV.dev vulnerability record aggregator", "type": "string" } }, "required": [ "name" ], "type": "object" } }, "required": [ "osv", "cisa_kev" ], "type": "object" }, "stale": { "description": "True only when a prior validated CISA KEV snapshot is served after refresh failure; OSV result completeness is never silently marked stale", "type": "boolean" }, "warnings": { "description": "Freshness and interpretation warnings; always [] when none", "items": { "description": "Bounded warning intended for caller action or interpretation", "type": "string" }, "type": "array" } }, "required": [ "operation", "schema_version", "source", "retrieved_at", "stale", "warnings", "results", "partial" ], "type": "object" }, "type": { "type": "string" } }, "required": [ "type" ], "type": "object" } }, "required": [ "input" ], "type": "object" }, "tags": [ "batch-vulnerability-check", "osv", "cve", "cisa-kev", "software-supply-chain" ] } } }, "liveness": { "reliability": null }, "verified": false, "featured": false, "provider": { "host": "dependency-risk.use.x402atlas.com", "manifest_name": "dependency-risk.use.x402atlas.com", "source": "cdp-mirror", "source_manifest_url": "https://api.cdp.coinbase.com/platform/v2/x402/discovery/resources", "submitted_at": "2026-10-14T01:15:01.050Z" }, "exampleResponse": { "example": { "_atlas": { "docs": "https://example.com", "related": [ { "bridge": "string", "docs": "https://example.com", "summary": "string", "url": "https://example.com" } ] }, "operation": "string", "partial": true, "results": [ { "error_code": "string", "findings": [ { "affected": [ "value" ], "aliases": [ "value" ], "fixed_versions": [ "value" ], "id": "string", "kev": { "cve_id": null, "cwes": null, "date_added": null, "due_date": null, "known_ransomware_campaign_use": null, "notes": null, "product": null, "required_action": null, "short_description": null, "vendor_project": null, "vulnerability_name": null }, "max_severity": "unknown", "modified": "string", "published": "string", "references": [ "value" ], "severity": [ "value" ], "summary": "string", "withdrawn": true, "withdrawn_at": "string" } ], "input": { "ecosystem": "string", "name": "string", "purl": "string", "version": "string" }, "status": "no_known_vulnerabilities", "summary": { "finding_count": 0, "kev_count": 0, "max_severity": "unknown" } } ], "retrieved_at": "2026-01-01T00:00:00Z", "schema_version": "string", "source": { "cisa_kev": { "catalog_version": "string", "date_released": "string", "name": "string", "retrieved_at": "2026-01-01T00:00:00Z" }, "osv": { "name": "string" } }, "stale": true, "warnings": [ "string" ] }, "type": "string" } }