[ranjiGT]

Updates

• References

Comments

Summary

The advisory for CVE-2026-35582 (GHSA-3p24-9x7v-7789) currently includes the upstream security advisory, the fixing commit, and the NVD record, but omits the official Emissary 8.43.0 release.

This PR adds the missing release reference to improve traceability between the existing security fix and its published patched version.

Changes

Field	Before	After
References	Upstream security advisory, fix commit, and NVD	Existing references plus the official Emissary 8.43.0 release

Supporting evidence

• Upstream security advisory: GHSA-3p24-9x7v-7789
• Fix commit: NationalSecurityAgency/emissary@1faf33f
• Official patched release: https://github.com/NationalSecurityAgency/emissary/releases/tag/8.43.0

The existing advisory identifies 8.43.0 as the patched version. The official upstream release documents the corresponding Executrix security change.

Technical justification

The advisory already links to the fixing commit, but readers must separately locate the release containing that correction.

Adding the official 8.43.0 release provides a direct upstream reference for the published remediation without changing the existing vulnerability metadata.

Scope

This is a reference-only improvement. No changes are proposed to the description, affected package, affected or patched version ranges, severity, or CVSS vector.

[github]

Hi there @cfkoehler! A community member has suggested an improvement to your security advisory. If approved, this change will affect the global advisory listed at github.com/advisories. It will not affect the version listed in your project repository.

This change will be reviewed by our Security Curation Team. If you have thoughts or feedback, please share them in a comment here! If this PR has already been closed, you can start a new community contribution for this advisory

[Copilot]

🟢 Approval recommended

No active review issues are reported, and the change is limited to adding the official Emissary 8.43.0 release reference while preserving the existing advisory metadata.

No open issues 🎉

What changed in this PR

Adds the official Emissary 8.43.0 release reference to the GHSA-3p24-9x7v-7789 advisory, improving traceability to the patched release without changing the vulnerability metadata.

Changes:

• Adds the Emissary 8.43.0 GitHub release as a WEB reference.
• Updates the advisory modification timestamp.
• Preserves the existing affected versions, fixed version, severity, and other advisory fields.

File	Description
advisories/​github-reviewed/​2026/​04/​GHSA-3p24-9x7v-7789/​GHSA-3p24-9x7v-7789.json	Adds the official patched-release reference and updates the modification timestamp.

_{Review effort: Lite (auto)}