detectors/

Package assess judges one executable or shared library for CVE-2026-111497 from what internal/fingerprint reads in it, and names the fix for the software it belongs to.

Package fingerprint reads what a binary proves about the Brotli decoder it carries, without running it.

Package brotlipin finds the places a repository pins Node.js, .NET or Bun to a release whose bundled Brotli decoder lacks the fix for CVE-2026-111497 (Node2Shell, Broccoli2Shell: an out-of-bounds write in Brotli 1.0.3 through 1.2.0), and plans the deterministic one-line edit to the fixed release of the same line: Node.js 22.23.4, 24.22.1 and 26.12.1, .NET 8.0.33, 9.0.22 and 10.0.14, Bun 1.4.4.

Package testbin builds the small binaries the Brotli detector's tests read: decoder error tables exactly as each upstream release lays them out, and ELF, PE and Mach-O files that define or import decoder symbols.

Package assess decides whether each finding is live trust or an inert copy.

Package detect inspects one file's bytes and reports facts about it.

Package knowledge holds the certificates involved in the October 2026 eMudhra intermediate CA key compromise (Mozilla bug 2083449) and the facts the scanner matches on.

Package weakkey finds elliptic-curve public keys whose private scalar is tiny.

Package assess decides, for each PHP runtime found, whether it is vulnerable to CVE-2026-109618 and CVE-2026-109619, fixed, or unknown, and why.

Package detect recognises PHP runtimes (the CLI, PHP-FPM, CGI, the Apache module, LiteSpeed, FrankenPHP and embedded builds) by content, not by name, and reads the version each one was built as.

Package fix proposes and applies deterministic one-line fixes for image references that carry a PHP release vulnerable to CVE-2026-109618 and CVE-2026-109619.

Package image opens a container image and yields its final filesystem.

Package knowledge holds everything the scanner knows about CVE-2026-109618 and CVE-2026-109619: the upstream releases that fix them and, per distribution, the package versions that fix them or are known to be vulnerable.

Package netguard is the HTTP transport for registry lookups.

Package pkgdb reads the package databases a system or container image carries (dpkg, apk, rpm) and answers which installed package owns a file, so a PHP binary installed by a distribution is judged by that distribution's fix and not by its upstream version string.

Package rpmdb lets pkgdb read rpm sqlite databases (rpmdb.sqlite, rpm 4.16 and later: RHEL 9, Fedora 33+, Amazon Linux 2023, SLES 16).

Package registry resolves image references against their registries and decides, from image configuration alone, which PHP release each platform of an image carries.

Package registrytest runs an in-memory OCI registry for tests and builds images that look like the official php image and images derived from it.

Package repocheck judges the image references found in a repository: it resolves each one (once per distinct reference) and assesses it with registry.Assess.

Package report renders scan results as text, JSON or SARIF.

Package reposcan checks the image references in a source tree and plans the fix for each vulnerable one.

Package source feeds files to the scanner from a directory tree or a container image's flattened filesystem, and records every file it could not read so a scan never claims coverage it did not have.

Package version parses PHP release versions and compares distribution package versions with each package manager's own rules (dpkg, apk, rpm).