CVE-2026-59247 Insufficient verification of Hex package metadata in Gleam

[
  {
    "collectionURL": "https://gleam.run",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_cli::dependencies::dependency_manager"
    ],
    "packageName": "gleam.run/gleam",
    "packageURL": "pkg:sid/gleam.run/gleam",
    "product": "gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-cli/src/dependencies/dependency_manager.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::lookup_package"
      },
      {
        "name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
      }
    ],
    "repo": "https://github.com/gleam-lang/gleam",
    "vendor": "gleam-lang",
    "versions": [
      {
        "lessThan": "1.18.0",
        "status": "affected",
        "version": "0.18.0",
        "versionType": "semver"
      }
    ]
  },
  {
    "collectionURL": "https://github.com",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_cli::dependencies::dependency_manager"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:github/gleam-lang/gleam",
    "product": "gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-cli/src/dependencies/dependency_manager.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::lookup_package"
      },
      {
        "name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
      }
    ],
    "repo": "https://github.com/gleam-lang/gleam",
    "vendor": "gleam-lang",
    "versions": [
      {
        "lessThan": "1.18.0",
        "status": "affected",
        "version": "0.18.0",
        "versionType": "semver"
      },
      {
        "lessThan": "c9c0d48c123c8abae6db8dd61b25ccb427ed3d35",
        "status": "affected",
        "version": "8447b78cc844ff4aec44eea23dbd68d1fea11f11",
        "versionType": "git"
      }
    ]
  },
  {
    "collectionURL": "https://ghcr.io",
    "cpes": [
      "cpe:2.3:a:gleam-lang:gleam:*:*:*:*:*:*:*:*"
    ],
    "defaultStatus": "unaffected",
    "modules": [
      "gleam_cli::dependencies",
      "gleam_cli::dependencies::dependency_manager"
    ],
    "packageName": "gleam-lang/gleam",
    "packageURL": "pkg:oci/gleam?repository_url=ghcr.io/gleam-lang",
    "product": "gleam",
    "programFiles": [
      "compiler-cli/src/dependencies.rs",
      "compiler-cli/src/dependencies/dependency_manager.rs"
    ],
    "programRoutines": [
      {
        "name": "gleam_cli::dependencies::lookup_package"
      },
      {
        "name": "gleam_cli::dependencies::dependency_manager::DependencyManager::perform_version_resolution"
      }
    ],
    "vendor": "gleam-lang",
    "versions": [
      {
        "lessThan": "v1.18.0-elixir",
        "status": "affected",
        "version": "v0.18.0-elixir",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-elixir-slim",
        "status": "affected",
        "version": "v0.18.0-elixir-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-elixir-alpine",
        "status": "affected",
        "version": "v0.18.0-elixir-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-erlang",
        "status": "affected",
        "version": "v0.18.0-erlang",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-erlang-slim",
        "status": "affected",
        "version": "v0.18.0-erlang-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-erlang-alpine",
        "status": "affected",
        "version": "v0.18.0-erlang-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-node",
        "status": "affected",
        "version": "v0.18.0-node",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-node-slim",
        "status": "affected",
        "version": "v0.18.0-node-slim",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-node-alpine",
        "status": "affected",
        "version": "v0.18.0-node-alpine",
        "versionType": "other"
      },
      {
        "lessThan": "v1.18.0-scratch",
        "status": "affected",
        "version": "v1.6.0-scratch",
        "versionType": "other"
      }
    ]
  }
]