Anthropic's CVD ledger attributes three findings to an unreleased model

Three qualifying Project Glasswing cards attribute four CVEs in dnsmasq and runc to an unreleased Anthropic model without inferring a released Claude variant.

Bug class: Memory corruption, denial of service, and container-runtime validation vulnerabilities
Affected codebase: dnsmasq and runc
Credited system: Anthropic unreleased CVD model
Disclosed: August 17, 2026
Attribution: Direct source attribution
AI role: Discovery
Severity: high

Source status: Three public Anthropic cards explicitly say an unreleased Anthropic model. They are fixed, patched, vendor-confirmed rows and contain four unique CVE IDs and two GHSAs.

Summary

The three cards identify only an unreleased Anthropic model. Bugflation keeps that label instead of assigning these four CVEs to Mythos, Opus, or Sonnet. All three rows are high severity under Anthropic’s vendor-first fallback.

References

Catalogued in the Bugflation public ledger. Disagree with the attribution or severity label? Email the desk.