Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-27137 (GCVE-0-2026-27137)
Vulnerability from cvelistv5 – Published: 2026-03-06 21:28 – Updated: 2026-08-20 12:31
VLAI
EPSS
VEX
Title
Incorrect enforcement of email constraints in crypto/x509
Summary
When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-10 13:32 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
56 references
Impacted products
110 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Go standard library | crypto/x509 |
Affected:
1.26.0-0 , < 1.26.1
(semver)
|
guessed | |
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:0.2.3-4.el10_1 , < *
(rpm)
Unaffected: 0:0.2.7-3.el10_2 , < * (rpm) cpe:/o:redhat:enterprise_linux:10.1 cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.25.2-3.el10_1 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.1 |
||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:1.26.2-2.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:0.9.27-6.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:165.1-2.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10 |
Unaffected:
0:52.1-1.el10_2 , < *
(rpm)
cpe:/o:redhat:enterprise_linux:10.2 |
||
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support |
Unaffected:
0:0.2.3-4.el10_0 , < *
(rpm)
cpe:/o:redhat:enterprise_linux_eus:10.0 |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:1.26.2-1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:165.1-2.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
||
| Red Hat | Red Hat Enterprise Linux 9 |
Unaffected:
0:52.1-1.el9_8 , < *
(rpm)
cpe:/a:redhat:enterprise_linux:9 |
||
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support |
Unaffected:
6:0.8.5-2.el9_6.2 , < *
(rpm)
cpe:/a:redhat:rhel_eus:9.6 |
||
| Red Hat | Red Hat OpenStack Platform 16.2 |
Unaffected:
0:0.2.1-1.1.el8ost , < *
(rpm)
cpe:/a:redhat:openstack:16.2::el8 |
||
| Red Hat | Red Hat OpenStack Platform 16.2 |
Unaffected:
0:3.3.23-22.el8ost , < *
(rpm)
cpe:/a:redhat:openstack:16.2::el8 |
||
| Red Hat | Red Hat OpenStack Platform 17.1 for RHEL 9 |
Unaffected:
0:3.4.26-9.5.el9ost , < *
(rpm)
cpe:/a:redhat:openstack:17.1::el9 |
||
| Red Hat | Red Hat OpenStack Services on OpenShift 18.0 |
Unaffected:
0:0.1.1-18.0.20260602234716.a95ae05.el9ost , < *
(rpm)
cpe:/a:redhat:openstack:18.0::el9 |
||
| Red Hat | RHEM 1.0 for RHEL 9 |
Unaffected:
0:1.0.3-1.el9em , < *
(rpm)
cpe:/a:redhat:edge_manager:1.0::el9 |
||
| Red Hat | RHEM 1.1 for RHEL 10 |
Unaffected:
0:1.1.3-1.el10em , < *
(rpm)
cpe:/a:redhat:edge_manager:1.1::el10 |
||
| Red Hat | RHEM 1.1 for RHEL 9 |
Unaffected:
0:1.1.3-1.el9em , < *
(rpm)
cpe:/a:redhat:edge_manager:1.1::el9 |
||
| Red Hat | Builds for Red Hat OpenShift 1.6.1 |
Unaffected:
1774334066 , < *
(rpm)
cpe:/a:redhat:openshift_builds:1.6::el9 |
||
| Red Hat | DevWorkspace Operator 0.4 |
Unaffected:
1776457293 , < *
(rpm)
cpe:/a:redhat:devworkspace:0.40::el9 |
||
| Red Hat | Logging for Red Hat OpenShift 6.4 |
Unaffected:
1780051640 , < *
(rpm)
cpe:/a:redhat:logging:6.4::el9 |
||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6 |
Unaffected:
1781192891 , < *
(rpm)
cpe:/a:redhat:logging:6.0::el9 |
||
| Red Hat | Logging Subsystem for Red Hat OpenShift 6.2 |
Unaffected:
1776800087 , < *
(rpm)
cpe:/a:redhat:logging:6.2::el9 |
||
| Red Hat | Multicluster Global Hub 1.3.4 |
Unaffected:
1779210675 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.3::el9 |
||
| Red Hat | Multicluster Global Hub 1.4.8 |
Unaffected:
1779838819 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.4::el9 |
||
| Red Hat | Multicluster Global Hub 1.6.2 |
Unaffected:
1780320809 , < *
(rpm)
cpe:/a:redhat:multicluster_globalhub:1.6::el9 |
||
| Red Hat | OpenShift API for Data Protection 1.4 |
Unaffected:
1779809598 , < *
(rpm)
cpe:/a:redhat:openshift_api_data_protection:1.4::el9 |
||
| Red Hat | OpenShift API for Data Protection 1.5 |
Unaffected:
1779808027 , < *
(rpm)
cpe:/a:redhat:openshift_api_data_protection:1.5::el9 |
||
| Red Hat | Red Hat Advanced Cluster Management for Kubernetes 2.15 |
Unaffected:
1774085848 , < *
(rpm)
cpe:/a:redhat:acm:2.15::el9 |
||
| Red Hat | Red Hat Ansible Automation Platform 2.6 |
Unaffected:
1777391542 , < *
(rpm)
cpe:/a:redhat:ansible_automation_platform:2.6::el9 |
||
| Red Hat | Red Hat Hardened Images |
Unaffected:
1.26.2-1.hum1 , < *
(rpm)
cpe:/a:redhat:hummingbird:1 |
||
| Red Hat | Red Hat Lightspeed (formerly Insights) for Runtimes 1.0 |
Unaffected:
1.0.2-1776288486 , < *
(rpm)
cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9 |
||
| Red Hat | Red Hat Migration Toolkit 1.8 |
Unaffected:
1783914276 , < *
(rpm)
cpe:/a:redhat:rhmt:1.8::el8 |
||
| Red Hat | Red Hat multicluster global hub 1.5.1 |
Unaffected:
1773650627 , < *
(rpm)
Unaffected: 1779828691 , < * (rpm) cpe:/a:redhat:multicluster_globalhub:1.5::el9 |
||
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1776773362 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
||
| Red Hat | Red Hat OpenShift Builds 1.7.4 |
Unaffected:
1776846936 , < *
(rpm)
cpe:/a:redhat:openshift_builds:1.7::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.27 |
Unaffected:
1776789889 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.27::el9 |
||
| Red Hat | Red Hat OpenShift distributed tracing 3.9.2 |
Unaffected:
1776435680 , < *
(rpm)
cpe:/a:redhat:openshift_distributed_tracing:3.9::el9 |
||
| Red Hat | Red Hat OpenShift GitOps 1.18 |
Unaffected:
1776755965 , < *
(rpm)
cpe:/a:redhat:openshift_gitops:1.18::el8 |
||
| Red Hat | Red Hat OpenShift GitOps 1.19 |
Unaffected:
1776767162 , < *
(rpm)
cpe:/a:redhat:openshift_gitops:1.19::el8 |
||
| Red Hat | Red Hat OpenShift GitOps 1.2 |
Unaffected:
1776773421 , < *
(rpm)
cpe:/a:redhat:openshift_gitops:1.20::el9 |
||
| Red Hat | Red Hat Quay 3.16 |
Unaffected:
1779204086 , < *
(rpm)
cpe:/a:redhat:quay:3.16::el9 |
||
| Red Hat | Red Hat Satellite 6.18 |
Unaffected:
1778082595 , < *
(rpm)
cpe:/a:redhat:satellite:6.18::el9 |
||
| Red Hat | Red Hat Trusted Artifact Signer 1.3 |
Unaffected:
1776339099 , < *
(rpm)
cpe:/a:redhat:trusted_artifact_signer:1.3::el9 |
||
| Red Hat | Red Hat Web Terminal 1.11 |
Unaffected:
1776966691 , < *
(rpm)
cpe:/a:redhat:webterminal:1.11::el9 |
||
| Red Hat | Red Hat Web Terminal 1.12 |
Unaffected:
1776959849 , < *
(rpm)
cpe:/a:redhat:webterminal:1.12::el9 |
||
| Red Hat | Red Hat Web Terminal 1.13 |
Unaffected:
1776197785 , < *
(rpm)
cpe:/a:redhat:webterminal:1.13::el9 |
||
| Red Hat | Red Hat Web Terminal 1.14 |
Unaffected:
1776199398 , < *
(rpm)
cpe:/a:redhat:webterminal:1.14::el9 |
||
| Red Hat | Red Hat Web Terminal 1.15 |
Unaffected:
1775672762 , < *
(rpm)
cpe:/a:redhat:webterminal:1.15::el9 |
||
| Red Hat | Assisted Installer for Red Hat OpenShift Container Platform 2 |
cpe:/a:redhat:assisted_installer:2
|
||
| Red Hat | cert-manager Operator for Red Hat OpenShift |
cpe:/a:redhat:cert_manager:1
|
||
| Red Hat | Compliance Operator |
cpe:/a:redhat:openshift_compliance_operator:1
|
||
| Red Hat | Confidential Compute Attestation |
cpe:/a:redhat:confidential_compute_attestation:1
|
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | Custom Metric Autoscaler operator for Red Hat Openshift |
cpe:/a:redhat:openshift_custom_metrics_autoscaler:2
|
||
| Red Hat | Deployment Validation Operator |
cpe:/a:redhat:deployment_validator_operator
|
||
| Red Hat | ExternalDNS Operator |
cpe:/a:redhat:ext_dns_optr:1
|
||
| Red Hat | External Secrets Operator for Red Hat OpenShift |
cpe:/a:redhat:external_secrets_operator:1
|
||
| Red Hat | Fence Agents Remediation Operator |
cpe:/a:redhat:workload_availability_far:0
|
||
| Red Hat | File Integrity Operator |
cpe:/a:redhat:openshift_file_integrity_operator:1
|
||
| Red Hat | Gatekeeper 3 |
cpe:/a:redhat:gatekeeper:3
|
||
| Red Hat | Logging Subsystem for Red Hat OpenShift |
cpe:/a:redhat:logging:5
|
||
| Red Hat | Logical Volume Manager Storage |
cpe:/a:redhat:lvms:4
|
||
| Red Hat | Machine Deletion Remediation Operator |
cpe:/a:redhat:workload_availability_mdr:0
|
||
| Red Hat | Migration Toolkit for Applications 8 |
cpe:/a:redhat:migration_toolkit_applications:8
|
||
| Red Hat | mirror registry for Red Hat OpenShift |
cpe:/a:redhat:mirror_registry:1
|
||
| Red Hat | mirror registry for Red Hat OpenShift 2 |
cpe:/a:redhat:mirror_registry:2
|
||
| Red Hat | Multicluster Engine for Kubernetes |
cpe:/a:redhat:multicluster_engine
|
||
| Red Hat | Network Observability Operator |
cpe:/a:redhat:network_observ_optr:1
|
||
| Red Hat | Node HealthCheck Operator |
cpe:/a:redhat:workload_availability_nhc:0
|
||
| Red Hat | OpenShift Developer Tools and Services |
cpe:/a:redhat:ocp_tools
|
||
| Red Hat | OpenShift Lightspeed |
cpe:/a:redhat:openshift_lightspeed
|
||
| Red Hat | OpenShift Pipelines |
cpe:/a:redhat:openshift_pipelines:1
|
||
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1
|
||
| Red Hat | OpenShift Service Mesh 2 |
cpe:/a:redhat:service_mesh:2
|
||
| Red Hat | OpenShift Service Mesh 3 |
cpe:/a:redhat:service_mesh:3
|
||
| Red Hat | Power monitoring for Red Hat OpenShift |
cpe:/a:redhat:openshift_power_monitoring
|
||
| Red Hat | Red Hat 3scale API Management Platform 2 |
cpe:/a:redhat:red_hat_3scale_amp:2
|
||
| Red Hat | Red Hat Advanced Cluster Security 4 |
cpe:/a:redhat:advanced_cluster_security:4
|
||
| Red Hat | Red Hat Ansible Automation Platform 2 |
cpe:/a:redhat:ansible_automation_platform:2
|
||
| Red Hat | Red Hat build of Apache Camel - HawtIO 4 |
cpe:/a:redhat:apache_camel_hawtio:4
|
||
| Red Hat | Red Hat Certification Program for Red Hat Enterprise Linux 9 |
cpe:/a:redhat:certifications:9
|
||
| Red Hat | Red Hat Connectivity Link 1 |
cpe:/a:redhat:connectivity_link:1
|
||
| Red Hat | Red Hat Developer Hub |
cpe:/a:redhat:rhdh:1
|
||
| Red Hat | Red Hat Edge Manager 1 |
cpe:/a:redhat:edge_manager:1
|
||
| Red Hat | Red Hat Enterprise Linux 10 |
cpe:/o:redhat:enterprise_linux:10
|
||
| Red Hat | Red Hat Enterprise Linux 7 |
cpe:/o:redhat:enterprise_linux:7
|
||
| Red Hat | Red Hat Enterprise Linux 8 |
cpe:/o:redhat:enterprise_linux:8
|
||
| Red Hat | Red Hat Enterprise Linux 9 |
cpe:/o:redhat:enterprise_linux:9
|
||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat OpenShift Cluster Manager CLI |
cpe:/a:redhat:openshift_cluster_manager_cli:1
|
||
| Red Hat | Red Hat OpenShift Container Platform 4 |
cpe:/a:redhat:openshift:4
|
||
| Red Hat | Red Hat Openshift Data Foundation 4 |
cpe:/a:redhat:openshift_data_foundation:4
|
||
| Red Hat | Red Hat OpenShift for Windows Containers |
cpe:/a:redhat:windows_machine_config
|
||
| Red Hat | Red Hat OpenShift on AWS |
cpe:/a:redhat:openshift_service_on_aws:1
|
||
| Red Hat | Red Hat OpenShift Virtualization 4 |
cpe:/a:redhat:container_native_virtualization:4
|
||
| Red Hat | Red Hat OpenStack Platform 16.2 |
cpe:/a:redhat:openstack:16.2
|
||
| Red Hat | Red Hat OpenStack Platform 17.1 |
cpe:/a:redhat:openstack:17.1
|
||
| Red Hat | Red Hat OpenStack Platform 18.0 |
cpe:/a:redhat:openstack:18.0
|
||
| Red Hat | Red Hat Quay 3 |
cpe:/a:redhat:quay:3
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Service Interconnect 1 |
cpe:/a:redhat:service_interconnect:1
|
||
| Red Hat | Red Hat Service Interconnect 2 |
cpe:/a:redhat:service_interconnect:2
|
||
| Red Hat | Security Profiles Operator |
cpe:/a:redhat:openshift_security_profiles_operator:1
|
||
| Red Hat | Service Telemetry Framework 1.5 |
cpe:/a:redhat:stf:1.5
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
||
| Red Hat | Zero Trust Workload Identity Manager |
cpe:/a:redhat:zero_trust_workload_identity_manager:1
|
||
| Red Hat | Zero Trust Workload Identity Manager - Tech Preview |
cpe:/a:redhat:zero_trust_workload_identity_manager:0
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-27137",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-10T13:32:09.097820Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-10T13:32:53.202Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1",
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "rhc-worker-playbook",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.2.3-4.el10_1",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.2.7-3.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.1"
],
"defaultStatus": "affected",
"packageName": "delve",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.25.2-3.el10_1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.2-2.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "golang-github-openprinting-ipp-usb",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.9.27-6.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:165.1-2.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"defaultStatus": "affected",
"packageName": "image-builder",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:52.1-1.el10_2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"defaultStatus": "affected",
"packageName": "rhc-worker-playbook",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.2.3-4.el10_0",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.26.2-1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:165.1-2.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "image-builder",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:52.1-1.el9_8",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "6:0.8.5-2.el9_6.2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:16.2::el8"
],
"defaultStatus": "affected",
"packageName": "collectd-sensubility",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.2.1-1.1.el8ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openstack:16.2::el8"
],
"defaultStatus": "affected",
"packageName": "etcd",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.3.23-22.el8ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1::el9"
],
"defaultStatus": "affected",
"packageName": "etcd",
"product": "Red Hat OpenStack Platform 17.1 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:3.4.26-9.5.el9ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0::el9"
],
"defaultStatus": "affected",
"packageName": "golang-github-openstack-k8s-operators-os-diff",
"product": "Red Hat OpenStack Services on OpenShift 18.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:0.1.1-18.0.20260602234716.a95ae05.el9ost",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.0::el9"
],
"defaultStatus": "affected",
"packageName": "flightctl",
"product": "RHEM 1.0 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.0.3-1.el9em",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.1::el10"
],
"defaultStatus": "affected",
"packageName": "flightctl",
"product": "RHEM 1.1 for RHEL 10",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.3-1.el10em",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1.1::el9"
],
"defaultStatus": "affected",
"packageName": "flightctl",
"product": "RHEM 1.1 for RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.1.3-1.el9em",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_builds:1.6::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-builds/openshift-builds-waiters-rhel9",
"product": "Builds for Red Hat OpenShift 1.6.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774334066",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:devworkspace:0.40::el9"
],
"defaultStatus": "affected",
"packageName": "devworkspace/devworkspace-rhel9-operator",
"product": "DevWorkspace Operator 0.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776457293",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.4::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/eventrouter-rhel9",
"product": "Logging for Red Hat OpenShift 6.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780051640",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.0::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/eventrouter-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift 6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1781192891",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:logging:6.2::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/eventrouter-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift 6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776800087",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
"product": "Multicluster Global Hub 1.3.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779210675",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
"product": "Multicluster Global Hub 1.4.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779838819",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.6::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
"product": "Multicluster Global Hub 1.6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780320809",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.4::el9"
],
"defaultStatus": "affected",
"packageName": "oadp/oadp-velero-rhel9",
"product": "OpenShift API for Data Protection 1.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779809598",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
],
"defaultStatus": "affected",
"packageName": "oadp/oadp-velero-rhel9",
"product": "OpenShift API for Data Protection 1.5",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779808027",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:acm:2.15::el9"
],
"defaultStatus": "affected",
"packageName": "rhacm2/subctl-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1774085848",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2.6::el9"
],
"defaultStatus": "affected",
"packageName": "ansible-automation-platform-26/receptor-rhel9",
"product": "Red Hat Ansible Automation Platform 2.6",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1777391542",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:hummingbird:1"
],
"defaultStatus": "affected",
"packageName": "golang1-26-main",
"product": "Red Hat Hardened Images",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.26.2-1.hum1",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9"
],
"defaultStatus": "affected",
"packageName": "rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator",
"product": "Red Hat Lightspeed (formerly Insights) for Runtimes 1.0",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1.0.2-1776288486",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:rhmt:1.8::el8"
],
"defaultStatus": "affected",
"packageName": "rhmtc/openshift-migration-registry-rhel8",
"product": "Red Hat Migration Toolkit 1.8",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783914276",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:multicluster_globalhub:1.5::el9"
],
"defaultStatus": "affected",
"packageName": "multicluster-globalhub/multicluster-globalhub-agent-rhel9",
"product": "Red Hat multicluster global hub 1.5.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1773650627",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "1779828691",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-rhel9-operator",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776773362",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_builds:1.7::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-builds/openshift-builds-waiters-rhel9",
"product": "Red Hat OpenShift Builds 1.7.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776846936",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.27::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/udi-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.27",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776789889",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9"
],
"defaultStatus": "affected",
"packageName": "rhosdt/tempo-rhel9",
"product": "Red Hat OpenShift distributed tracing 3.9.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776435680",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.18::el8"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/dex-rhel8",
"product": "Red Hat OpenShift GitOps 1.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776755965",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.19::el8"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/dex-rhel8",
"product": "Red Hat OpenShift GitOps 1.19",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776767162",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1.20::el9"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/dex-rhel9",
"product": "Red Hat OpenShift GitOps 1.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776773421",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:quay:3.16::el9"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel9",
"product": "Red Hat Quay 3.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1779204086",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:satellite:6.18::el9"
],
"defaultStatus": "affected",
"packageName": "satellite/iop-vmaas-rhel9",
"product": "Red Hat Satellite 6.18",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1778082595",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1.3::el9"
],
"defaultStatus": "affected",
"packageName": "rhtas/client-server-rhel9",
"product": "Red Hat Trusted Artifact Signer 1.3",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776339099",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:webterminal:1.11::el9"
],
"defaultStatus": "affected",
"packageName": "web-terminal/web-terminal-exec-rhel9",
"product": "Red Hat Web Terminal 1.11",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776966691",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:webterminal:1.12::el9"
],
"defaultStatus": "affected",
"packageName": "web-terminal/web-terminal-exec-rhel9",
"product": "Red Hat Web Terminal 1.12",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776959849",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:webterminal:1.13::el9"
],
"defaultStatus": "affected",
"packageName": "web-terminal/web-terminal-exec-rhel9",
"product": "Red Hat Web Terminal 1.13",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776197785",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:webterminal:1.14::el9"
],
"defaultStatus": "affected",
"packageName": "web-terminal/web-terminal-exec-rhel9",
"product": "Red Hat Web Terminal 1.14",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1776199398",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:webterminal:1.15::el9"
],
"defaultStatus": "affected",
"packageName": "web-terminal/web-terminal-exec-rhel9",
"product": "Red Hat Web Terminal 1.15",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1775672762",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:assisted_installer:2"
],
"defaultStatus": "affected",
"packageName": "rhai/assisted-installer-rhel9",
"product": "Assisted Installer for Red Hat OpenShift Container Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cert_manager:1"
],
"defaultStatus": "unaffected",
"packageName": "cert-manager/jetstack-cert-manager-rhel9",
"product": "cert-manager Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_compliance_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "compliance/openshift-compliance-operator-bundle",
"product": "Compliance Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "build-of-trustee/trustee-rhel9-operator",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:confidential_compute_attestation:1"
],
"defaultStatus": "affected",
"packageName": "openshift-sandboxed-containers/osc-monitor-rhel9",
"product": "Confidential Compute Attestation",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "unaffected",
"packageName": "cryostat/cryostat-storage-rhel9",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2"
],
"defaultStatus": "unaffected",
"packageName": "custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9",
"product": "Custom Metric Autoscaler operator for Red Hat Openshift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:deployment_validator_operator"
],
"defaultStatus": "affected",
"packageName": "dvo/deployment-validation-rhel8-operator",
"product": "Deployment Validation Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ext_dns_optr:1"
],
"defaultStatus": "affected",
"packageName": "edo/external-dns-rhel8",
"product": "ExternalDNS Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ext_dns_optr:1"
],
"defaultStatus": "affected",
"packageName": "edo/external-dns-rhel9",
"product": "ExternalDNS Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:external_secrets_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "external-secrets-operator/external-secrets-rhel9",
"product": "External Secrets Operator for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:workload_availability_far:0"
],
"defaultStatus": "affected",
"packageName": "workload-availability/fence-agents-remediation-rhel8-operator",
"product": "Fence Agents Remediation Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_file_integrity_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "compliance/openshift-compliance-operator-bundle",
"product": "File Integrity Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:gatekeeper:3"
],
"defaultStatus": "affected",
"packageName": "gatekeeper/gatekeeper-rhel9-operator",
"product": "Gatekeeper 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/eventrouter-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:logging:5"
],
"defaultStatus": "affected",
"packageName": "openshift-logging/logging-loki-rhel9",
"product": "Logging Subsystem for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"packageName": "lvms4/lvms-rhel9-operator",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"packageName": "lvms4/topolvm-rhel8",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:lvms:4"
],
"defaultStatus": "affected",
"packageName": "lvms4/topolvm-rhel9",
"product": "Logical Volume Manager Storage",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:workload_availability_mdr:0"
],
"defaultStatus": "unaffected",
"packageName": "workload-availability/machine-deletion-remediation-rhel8-operator",
"product": "Machine Deletion Remediation Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:migration_toolkit_applications:8"
],
"defaultStatus": "unaffected",
"packageName": "mta/mta-cli-rhel9",
"product": "Migration Toolkit for Applications 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:mirror_registry:1"
],
"defaultStatus": "affected",
"packageName": "openshift/mirror-registry-rhel8",
"product": "mirror registry for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:mirror_registry:2"
],
"defaultStatus": "unaffected",
"packageName": "openshift/mirror-registry-rhel8",
"product": "mirror registry for Red Hat OpenShift 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:multicluster_engine"
],
"defaultStatus": "unaffected",
"packageName": "multicluster-engine/discovery-rhel9",
"product": "Multicluster Engine for Kubernetes",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:network_observ_optr:1"
],
"defaultStatus": "unaffected",
"packageName": "network-observability/network-observability-cli-rhel9",
"product": "Network Observability Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:workload_availability_nhc:0"
],
"defaultStatus": "unaffected",
"packageName": "workload-availability/node-healthcheck-rhel8-operator",
"product": "Node HealthCheck Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "helm",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-agent-base-rhel9",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ocp_tools"
],
"defaultStatus": "affected",
"packageName": "ocp-tools-4/jenkins-rhel8",
"product": "OpenShift Developer Tools and Services",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_lightspeed"
],
"defaultStatus": "affected",
"packageName": "openshift-lightspeed/lightspeed-rhel9-operator",
"product": "OpenShift Lightspeed",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines-client",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "unaffected",
"packageName": "kn-workflow-plugin",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-plugin-event-sender-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-clients",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "unaffected",
"packageName": "openshift-golang-builder-container",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:2"
],
"defaultStatus": "unaffected",
"packageName": "openshift-service-mesh/kiali-rhel8",
"product": "OpenShift Service Mesh 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"packageName": "openshift-golang-builder-container",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_mesh:3"
],
"defaultStatus": "unaffected",
"packageName": "openshift-service-mesh/kiali-rhel9",
"product": "OpenShift Service Mesh 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_power_monitoring"
],
"defaultStatus": "unaffected",
"packageName": "openshift-power-monitoring/kepler-rhel9",
"product": "Power monitoring for Red Hat OpenShift",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/3scale-rhel7-operator",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp2/3scale-rhel9-operator",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp26/3scale-operator",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_3scale_amp:2"
],
"defaultStatus": "affected",
"packageName": "3scale-amp26/operator",
"product": "Red Hat 3scale API Management Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "unaffected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "ansible-automation-platform/platform-operator-bundle",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "automation-gateway-proxy",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "automation-gateway-proxy-openssl30",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "automation-gateway-proxy-openssl32",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.11-grpcio",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.12-galaxy-ng",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3.12-grpcio",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python3x-grpcio",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "python-grpcio",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:ansible_automation_platform:2"
],
"defaultStatus": "unaffected",
"packageName": "receptor",
"product": "Red Hat Ansible Automation Platform 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_hawtio:4"
],
"defaultStatus": "affected",
"packageName": "hawtio-operator-container",
"product": "Red Hat build of Apache Camel - HawtIO 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"packageName": "redhat-certification-preflight",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:connectivity_link:1"
],
"defaultStatus": "affected",
"packageName": "rhcl-1/coredns-rhel9",
"product": "Red Hat Connectivity Link 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:rhdh:1"
],
"defaultStatus": "affected",
"packageName": "rhdh/rhdh-rhel9-operator",
"product": "Red Hat Developer Hub",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:edge_manager:1"
],
"defaultStatus": "unaffected",
"packageName": "rhem/flightctl-ui-rhel9",
"product": "Red Hat Edge Manager 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "buildah",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "butane",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "conmon",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "git-lfs",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "go-fdo-client",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "go-fdo-server",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "grafana-pcp",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "ignition",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "podman",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "rhc",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "rhel10/bootc-image-builder",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "toolbox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "trustee",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "unaffected",
"packageName": "trustee-guest-components",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "yggdrasil",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "host-metering",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "rhc",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"defaultStatus": "unaffected",
"packageName": "rhc-worker-script",
"product": "Red Hat Enterprise Linux 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "container-tools:rhel8/buildah",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "container-tools:rhel8/conmon",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "container-tools:rhel8/containernetworking-plugins",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "container-tools:rhel8/podman",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "container-tools:rhel8/runc",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "container-tools:rhel8/skopeo",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "container-tools:rhel8/toolbox",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "git-lfs",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "go-toolset:rhel8/golang",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "grafana-pcp",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "osbuild-composer",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "unaffected",
"packageName": "rhc",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:8"
],
"defaultStatus": "affected",
"packageName": "weldr-client",
"product": "Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "buildah",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "butane",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "conmon",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "containernetworking-plugins",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "git-lfs",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "grafana",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "grafana-pcp",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "ignition",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "podman",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "rhc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "rhel9/bootc-image-builder",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "runc",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "skopeo",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "toolbox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "unaffected",
"packageName": "trustee-guest-components",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "weldr-client",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "affected",
"packageName": "golang",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-cli-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-rhel8-operator",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_cluster_manager_cli:1"
],
"defaultStatus": "affected",
"packageName": "ocm-cli-clients/ocm-cli-rhel9",
"product": "Red Hat OpenShift Cluster Manager CLI",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "butane",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "conmon",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "conmon-rs",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "containernetworking-plugins",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "cri-o",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "cri-tools",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "golang-github-prometheus-promu",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "ignition",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "kata-containers",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "microshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/frr-rhel8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/frr-rhel9",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-sdn-rhel8",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift-clients",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift-golang-builder-container",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift-kuryr",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "ose-aws-ecr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "ose-azure-acr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "ose-gcp-gcr-image-credential-provider",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "podman",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "runc",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "unaffected",
"packageName": "skopeo",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_data_foundation:4"
],
"defaultStatus": "affected",
"packageName": "odf4/cephcsi-rhel9",
"product": "Red Hat Openshift Data Foundation 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:windows_machine_config"
],
"defaultStatus": "unaffected",
"packageName": "openshift4-wincw/windows-machine-config-rhel9-operator",
"product": "Red Hat OpenShift for Windows Containers",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_service_on_aws:1"
],
"defaultStatus": "affected",
"packageName": "rosa",
"product": "Red Hat OpenShift on AWS",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/virt-api",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "container-native-virtualization/virt-api-rhel9",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "kubevirt",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:container_native_virtualization:4"
],
"defaultStatus": "unaffected",
"packageName": "openshift-golang-builder-container",
"product": "Red Hat OpenShift Virtualization 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "affected",
"packageName": "golang-github-infrawatch-apputils",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:16.2"
],
"defaultStatus": "unaffected",
"packageName": "rhosp-rhel8/osp-director-agent",
"product": "Red Hat OpenStack Platform 16.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "collectd-libpod-stats",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "affected",
"packageName": "golang-github-infrawatch-apputils",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:17.1"
],
"defaultStatus": "unaffected",
"packageName": "rhosp-rhel9/osp-director-agent",
"product": "Red Hat OpenStack Platform 17.1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openstack:18.0"
],
"defaultStatus": "affected",
"packageName": "rhoso-operators/sg-core-rhel9",
"product": "Red Hat OpenStack Platform 18.0",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "unaffected",
"packageName": "quay/quay-builder-rhel8",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quay:3"
],
"defaultStatus": "affected",
"packageName": "quay/quay-rhel8",
"product": "Red Hat Quay 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/yggdrasil-worker-forwarder",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "affected",
"packageName": "yggdrasil-worker-forwarder",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_interconnect:1"
],
"defaultStatus": "unaffected",
"packageName": "skupper-cli",
"product": "Red Hat Service Interconnect 1",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_interconnect:2"
],
"defaultStatus": "unaffected",
"packageName": "skupper-cli",
"product": "Red Hat Service Interconnect 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_security_profiles_operator:1"
],
"defaultStatus": "unaffected",
"packageName": "compliance/openshift-selinuxd-rhel8",
"product": "Security Profiles Operator",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:stf:1.5"
],
"defaultStatus": "unaffected",
"packageName": "stf/sg-core-rhel9",
"product": "Service Telemetry Framework 1.5",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "golang-github-danielqsj-kafka_exporter",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:1"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9",
"product": "Zero Trust Workload Identity Manager",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2026-03-06T21:28:13.748Z",
"descriptions": [
{
"lang": "en",
"value": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T12:31:59.833Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"name": "RHBZ#2445345",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41019"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54757"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36796"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28047"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:39810"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10929"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8842"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10169"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19022"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19049"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19132"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19181"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5549"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9872"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:11800"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:22347"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:29854"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8151"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:13545"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:7291"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9052"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41928"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10184"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10158"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10175"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9697"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9698"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9699"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:9385"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:19375"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:14879"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10125"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10250"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:10225"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8338"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8337"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:8167"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:5110"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:21769"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:54757: Red Hat OpenStack Platform 16.2"
},
{
"lang": "en",
"value": "RHSA-2026:36796: RHEM 1.0 for RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:28047: Red Hat OpenStack Platform 17.1"
},
{
"lang": "en",
"value": "RHSA-2026:39810: 9Base-RHOSO-TOOLS-18, Red Hat OpenStack Services on OpenShift 18.0"
},
{
"lang": "en",
"value": "RHSA-2026:10929: Red Hat Enterprise Linux AppStream EUS (v. 10.0)"
},
{
"lang": "en",
"value": "RHSA-2026:8842: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:10169: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19022: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19049: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:19132: Red Hat Enterprise Linux AppStream (v. 10)"
},
{
"lang": "en",
"value": "RHSA-2026:28038: Red Hat Enterprise Linux AppStream EUS (v.9.6)"
},
{
"lang": "en",
"value": "RHSA-2026:19181: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)"
},
{
"lang": "en",
"value": "RHSA-2026:5549: Builds for Red Hat OpenShift 1.6.1"
},
{
"lang": "en",
"value": "RHSA-2026:9872: DevWorkspace Operator 0.4"
},
{
"lang": "en",
"value": "RHSA-2026:11800: Logging Subsystem for Red Hat OpenShift 6.2"
},
{
"lang": "en",
"value": "RHSA-2026:26585: Logging Subsystem for Red Hat OpenShift 6"
},
{
"lang": "en",
"value": "RHSA-2026:22862: Logging for Red Hat OpenShift 6.4"
},
{
"lang": "en",
"value": "RHSA-2026:22423: Multicluster Global Hub 1.3.4"
},
{
"lang": "en",
"value": "RHSA-2026:22347: Multicluster Global Hub 1.4.8"
},
{
"lang": "en",
"value": "RHSA-2026:23345: Multicluster Global Hub 1.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:29854: OpenShift API for Data Protection 1.4"
},
{
"lang": "en",
"value": "RHSA-2026:26568: OpenShift API for Data Protection 1.5"
},
{
"lang": "en",
"value": "RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15"
},
{
"lang": "en",
"value": "RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6"
},
{
"lang": "en",
"value": "RHSA-2026:7291: Red Hat Hardened Images"
},
{
"lang": "en",
"value": "RHSA-2026:9052: Red Hat Lightspeed (formerly Insights) for Runtimes 1.0"
},
{
"lang": "en",
"value": "RHSA-2026:41928: Red Hat Migration Toolkit 1.8"
},
{
"lang": "en",
"value": "RHSA-2026:10184: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:10158: Red Hat OpenShift Builds 1.7.4"
},
{
"lang": "en",
"value": "RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27"
},
{
"lang": "en",
"value": "RHSA-2026:9697: Red Hat OpenShift GitOps 1.18"
},
{
"lang": "en",
"value": "RHSA-2026:9698: Red Hat OpenShift GitOps 1.19"
},
{
"lang": "en",
"value": "RHSA-2026:9699: Red Hat OpenShift GitOps 1.2"
},
{
"lang": "en",
"value": "RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.2"
},
{
"lang": "en",
"value": "RHSA-2026:19375: Red Hat Quay 3.16"
},
{
"lang": "en",
"value": "RHSA-2026:14879: Red Hat Satellite 6.18"
},
{
"lang": "en",
"value": "RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3"
},
{
"lang": "en",
"value": "RHSA-2026:10250: Red Hat Web Terminal 1.11"
},
{
"lang": "en",
"value": "RHSA-2026:10225: Red Hat Web Terminal 1.12"
},
{
"lang": "en",
"value": "RHSA-2026:8338: Red Hat Web Terminal 1.13"
},
{
"lang": "en",
"value": "RHSA-2026:8337: Red Hat Web Terminal 1.14"
},
{
"lang": "en",
"value": "RHSA-2026:8167: Red Hat Web Terminal 1.15"
},
{
"lang": "en",
"value": "RHSA-2026:5110: Red Hat multicluster global hub 1.5.1"
},
{
"lang": "en",
"value": "RHSA-2026:21769: Red Hat multicluster global hub 1.5.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-03-06T22:01:38.859Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-03-06T21:28:13.748Z",
"value": "Made public."
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "crypto/x509",
"product": "crypto/x509",
"programRoutines": [
{
"name": "newEmailConstraints"
},
{
"name": "emailConstraints.query"
},
{
"name": "checkConstraints"
},
{
"name": "checkChainConstraints"
},
{
"name": "parseMailboxes"
},
{
"name": "Certificate.Verify"
}
],
"vendor": "Go standard library",
"versions": [
{
"lessThan": "1.26.1",
"status": "affected",
"version": "1.26.0-0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Jakub Ciolek"
}
],
"descriptions": [
{
"lang": "en",
"value": "When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-295: Improper Certificate Validation",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-03-08T05:56:20.771Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://go.dev/cl/752182"
},
{
"url": "https://go.dev/issue/77952"
},
{
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"title": "Incorrect enforcement of email constraints in crypto/x509"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2026-27137",
"datePublished": "2026-03-06T21:28:13.748Z",
"dateReserved": "2026-02-17T19:57:28.434Z",
"dateUpdated": "2026-08-20T12:31:59.833Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-27137",
"date": "2026-08-21",
"epss": "0.00606",
"percentile": "0.46483"
},
"microsoft_vex": {
"current_release_date": "2026-03-14T01:37:36.000Z",
"cve": "CVE-2026-27137",
"id": "msrc_CVE-2026-27137",
"initial_release_date": "2026-03-02T00:00:00.000Z",
"product_status:fixed": "2",
"product_status:known_affected": "2",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Incorrect enforcement of email constraints in crypto/x509",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-27137.json",
"version": "2"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-27137\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2026-03-06T22:16:00.850\",\"lastModified\":\"2026-08-19T12:17:37.737\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.\"},{\"lang\":\"es\",\"value\":\"Al verificar una cadena de certificados que contiene un certificado con m\u00faltiples restricciones de direcci\u00f3n de correo electr\u00f3nico que comparten porciones locales comunes pero porciones de dominio diferentes, estas restricciones no se aplicar\u00e1n correctamente, y solo la \u00faltima restricci\u00f3n ser\u00e1 considerada.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"Go standard library\",\"product\":\"crypto/x509\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"crypto/x509\",\"programRoutines\":[{\"name\":\"newEmailConstraints\"},{\"name\":\"emailConstraints.query\"},{\"name\":\"checkConstraints\"},{\"name\":\"checkChainConstraints\"},{\"name\":\"parseMailboxes\"},{\"name\":\"Certificate.Verify\"}],\"versions\":[{\"version\":\"1.26.0-0\",\"lessThan\":\"1.26.1\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhc-worker-playbook\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\",\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:0.2.3-4.el10_1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"0:0.2.7-3.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"delve\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.1\"],\"versions\":[{\"version\":\"0:1.25.2-3.el10_1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:1.26.2-2.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"golang-github-openprinting-ipp-usb\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:0.9.27-6.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:165.1-2.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10.2\"],\"versions\":[{\"version\":\"0:52.1-1.el10_2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10.0 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc-worker-playbook\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux_eus:10.0\"],\"versions\":[{\"version\":\"0:0.2.3-4.el10_0\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:1.26.2-1.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:165.1-2.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"image-builder\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux:9\"],\"versions\":[{\"version\":\"0:52.1-1.el9_8\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9.6 Extended Update Support\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/a:redhat:rhel_eus:9.6\"],\"versions\":[{\"version\":\"6:0.8.5-2.el9_6.2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"collectd-sensubility\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2::el8\"],\"versions\":[{\"version\":\"0:0.2.1-1.1.el8ost\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"etcd\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2::el8\"],\"versions\":[{\"version\":\"0:3.3.23-22.el8ost\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"etcd\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1::el9\"],\"versions\":[{\"version\":\"0:3.4.26-9.5.el9ost\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Services on OpenShift 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang-github-openstack-k8s-operators-os-diff\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0::el9\"],\"versions\":[{\"version\":\"0:0.1.1-18.0.20260602234716.a95ae05.el9ost\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.0 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.0::el9\"],\"versions\":[{\"version\":\"0:1.0.3-1.el9em\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.1 for RHEL 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.1::el10\"],\"versions\":[{\"version\":\"0:1.1.3-1.el10em\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"RHEM 1.1 for RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"flightctl\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1.1::el9\"],\"versions\":[{\"version\":\"0:1.1.3-1.el9em\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Builds for Red Hat OpenShift 1.6.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-builds/openshift-builds-waiters-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.6::el9\"],\"versions\":[{\"version\":\"1774334066\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"DevWorkspace Operator 0.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devworkspace/devworkspace-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:devworkspace:0.40::el9\"],\"versions\":[{\"version\":\"1776457293\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging for Red Hat OpenShift 6.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/eventrouter-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.4::el9\"],\"versions\":[{\"version\":\"1780051640\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/eventrouter-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.0::el9\"],\"versions\":[{\"version\":\"1781192891\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift 6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-logging/eventrouter-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:6.2::el9\"],\"versions\":[{\"version\":\"1776800087\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.3.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"],\"versions\":[{\"version\":\"1779210675\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.4.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"],\"versions\":[{\"version\":\"1779838819\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Global Hub 1.6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"],\"versions\":[{\"version\":\"1780320809\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"oadp/oadp-velero-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"],\"versions\":[{\"version\":\"1779809598\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift API for Data Protection 1.5\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"oadp/oadp-velero-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"],\"versions\":[{\"version\":\"1779808027\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Management for Kubernetes 2.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhacm2/subctl-rhel9\",\"cpes\":[\"cpe:/a:redhat:acm:2.15::el9\"],\"versions\":[{\"version\":\"1774085848\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2.6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"ansible-automation-platform-26/receptor-rhel9\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"],\"versions\":[{\"version\":\"1777391542\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Hardened Images\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang1-26-main\",\"cpes\":[\"cpe:/a:redhat:hummingbird:1\"],\"versions\":[{\"version\":\"1.26.2-1.hum1\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Lightspeed (formerly Insights) for Runtimes 1.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"],\"versions\":[{\"version\":\"1.0.2-1776288486\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Migration Toolkit 1.8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhmtc/openshift-migration-registry-rhel8\",\"cpes\":[\"cpe:/a:redhat:rhmt:1.8::el8\"],\"versions\":[{\"version\":\"1783914276\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat multicluster global hub 1.5.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"multicluster-globalhub/multicluster-globalhub-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"],\"versions\":[{\"version\":\"1773650627\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"1779828691\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1776773362\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Builds 1.7.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-builds/openshift-builds-waiters-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_builds:1.7::el9\"],\"versions\":[{\"version\":\"1776846936\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.27\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/udi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"],\"versions\":[{\"version\":\"1776789889\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift distributed tracing 3.9.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhosdt/tempo-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"],\"versions\":[{\"version\":\"1776435680\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/dex-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.18::el8\"],\"versions\":[{\"version\":\"1776755965\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.19\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/dex-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.19::el8\"],\"versions\":[{\"version\":\"1776767162\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift GitOps 1.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"openshift-gitops-1/dex-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_gitops:1.20::el9\"],\"versions\":[{\"version\":\"1776773421\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"quay/quay-rhel9\",\"cpes\":[\"cpe:/a:redhat:quay:3.16::el9\"],\"versions\":[{\"version\":\"1779204086\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6.18\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"satellite/iop-vmaas-rhel9\",\"cpes\":[\"cpe:/a:redhat:satellite:6.18::el9\"],\"versions\":[{\"version\":\"1778082595\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Trusted Artifact Signer 1.3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhtas/client-server-rhel9\",\"cpes\":[\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"],\"versions\":[{\"version\":\"1776339099\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.11\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"web-terminal/web-terminal-exec-rhel9\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.11::el9\"],\"versions\":[{\"version\":\"1776966691\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.12\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"web-terminal/web-terminal-exec-rhel9\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.12::el9\"],\"versions\":[{\"version\":\"1776959849\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.13\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"web-terminal/web-terminal-exec-rhel9\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.13::el9\"],\"versions\":[{\"version\":\"1776197785\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.14\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"web-terminal/web-terminal-exec-rhel9\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.14::el9\"],\"versions\":[{\"version\":\"1776199398\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Web Terminal 1.15\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"web-terminal/web-terminal-exec-rhel9\",\"cpes\":[\"cpe:/a:redhat:webterminal:1.15::el9\"],\"versions\":[{\"version\":\"1775672762\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Assisted Installer for Red Hat OpenShift Container Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhai/assisted-installer-rhel9\",\"cpes\":[\"cpe:/a:redhat:assisted_installer:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"cert-manager Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cert-manager/jetstack-cert-manager-rhel9\",\"cpes\":[\"cpe:/a:redhat:cert_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Compliance Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compliance/openshift-compliance-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openshift_compliance_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"build-of-trustee/trustee-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Confidential Compute Attestation\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-sandboxed-containers/osc-monitor-rhel9\",\"cpes\":[\"cpe:/a:redhat:confidential_compute_attestation:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cryostat/cryostat-storage-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Custom Metric Autoscaler operator for Red Hat Openshift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Deployment Validation Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"dvo/deployment-validation-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:deployment_validator_operator\"]},{\"vendor\":\"Red Hat\",\"product\":\"ExternalDNS Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"edo/external-dns-rhel8\",\"cpes\":[\"cpe:/a:redhat:ext_dns_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"ExternalDNS Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"edo/external-dns-rhel9\",\"cpes\":[\"cpe:/a:redhat:ext_dns_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"External Secrets Operator for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"external-secrets-operator/external-secrets-rhel9\",\"cpes\":[\"cpe:/a:redhat:external_secrets_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Fence Agents Remediation Operator\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"workload-availability/fence-agents-remediation-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_far:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"File Integrity Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compliance/openshift-compliance-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:openshift_file_integrity_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Gatekeeper 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gatekeeper/gatekeeper-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:gatekeeper:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/eventrouter-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logging Subsystem for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-logging/logging-loki-rhel9\",\"cpes\":[\"cpe:/a:redhat:logging:5\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/lvms-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/topolvm-rhel8\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Logical Volume Manager Storage\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"lvms4/topolvm-rhel9\",\"cpes\":[\"cpe:/a:redhat:lvms:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Machine Deletion Remediation Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"workload-availability/machine-deletion-remediation-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_mdr:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Migration Toolkit for Applications 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"mta/mta-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:migration_toolkit_applications:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"mirror registry for Red Hat OpenShift\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/mirror-registry-rhel8\",\"cpes\":[\"cpe:/a:redhat:mirror_registry:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"mirror registry for Red Hat OpenShift 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/mirror-registry-rhel8\",\"cpes\":[\"cpe:/a:redhat:mirror_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Multicluster Engine for Kubernetes\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"multicluster-engine/discovery-rhel9\",\"cpes\":[\"cpe:/a:redhat:multicluster_engine\"]},{\"vendor\":\"Red Hat\",\"product\":\"Network Observability Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"network-observability/network-observability-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:network_observ_optr:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Node HealthCheck Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"workload-availability/node-healthcheck-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:workload_availability_nhc:0\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"helm\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ocp-tools-4/jenkins-agent-base-rhel9\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Developer Tools and Services\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ocp-tools-4/jenkins-rhel8\",\"cpes\":[\"cpe:/a:redhat:ocp_tools\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Lightspeed\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-lightspeed/lightspeed-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_lightspeed\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Pipelines\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-pipelines-client\",\"cpes\":[\"cpe:/a:redhat:openshift_pipelines:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kn-workflow-plugin\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-plugin-event-sender-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-clients\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/kiali-rhel8\",\"cpes\":[\"cpe:/a:redhat:service_mesh:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Service Mesh 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-service-mesh/kiali-rhel9\",\"cpes\":[\"cpe:/a:redhat:service_mesh:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Power monitoring for Red Hat OpenShift\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-power-monitoring/kepler-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_power_monitoring\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/3scale-rhel7-operator\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp2/3scale-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp26/3scale-operator\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat 3scale API Management Platform 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"3scale-amp26/operator\",\"cpes\":[\"cpe:/a:redhat:red_hat_3scale_amp:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Advanced Cluster Security 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"advanced-cluster-security/rhacs-main-rhel8\",\"cpes\":[\"cpe:/a:redhat:advanced_cluster_security:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ansible-automation-platform/platform-operator-bundle\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy-openssl30\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"automation-gateway-proxy-openssl32\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.11-grpcio\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-galaxy-ng\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3.12-grpcio\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python3x-grpcio\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"python-grpcio\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Ansible Automation Platform 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"receptor\",\"cpes\":[\"cpe:/a:redhat:ansible_automation_platform:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel - HawtIO 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"hawtio-operator-container\",\"cpes\":[\"cpe:/a:redhat:apache_camel_hawtio:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Certification Program for Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"redhat-certification-preflight\",\"cpes\":[\"cpe:/a:redhat:certifications:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Connectivity Link 1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhcl-1/coredns-rhel9\",\"cpes\":[\"cpe:/a:redhat:connectivity_link:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Developer Hub\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhdh/rhdh-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:rhdh:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Edge Manager 1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhem/flightctl-ui-rhel9\",\"cpes\":[\"cpe:/a:redhat:edge_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"butane\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"git-lfs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"go-fdo-client\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"go-fdo-server\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana-pcp\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel10/bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"toolbox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trustee\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trustee-guest-components\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"yggdrasil\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"host-metering\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc-worker-script\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/conmon\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/containernetworking-plugins\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/runc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-tools:rhel8/toolbox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"git-lfs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"go-toolset:rhel8/golang\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana-pcp\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"osbuild-composer\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"weldr-client\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"buildah\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"butane\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"containernetworking-plugins\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"git-lfs\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"grafana-pcp\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"gvisor-tap-vsock\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"opentelemetry-collector\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhel9/bootc-image-builder\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"runc\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"toolbox\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"trustee-guest-components\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"weldr-client\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-rhel8-operator\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Cluster Manager CLI\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ocm-cli-clients/ocm-cli-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"butane\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"conmon-rs\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"containernetworking-plugins\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cri-o\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"cri-tools\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang-github-prometheus-promu\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ignition\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kata-containers\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"microshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/frr-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/frr-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4/ose-sdn-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-clients\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-kuryr\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ose-aws-ecr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ose-azure-acr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"ose-gcp-gcr-image-credential-provider\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"podman\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"runc\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skopeo\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Openshift Data Foundation 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"odf4/cephcsi-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_data_foundation:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift for Windows Containers\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift4-wincw/windows-machine-config-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:windows_machine_config\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift on AWS\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rosa\",\"cpes\":[\"cpe:/a:redhat:openshift_service_on_aws:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/virt-api\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"container-native-virtualization/virt-api-rhel9\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"kubevirt\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Virtualization 4\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-golang-builder-container\",\"cpes\":[\"cpe:/a:redhat:container_native_virtualization:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang-github-infrawatch-apputils\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 16.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosp-rhel8/osp-director-agent\",\"cpes\":[\"cpe:/a:redhat:openstack:16.2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"collectd-libpod-stats\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang-github-infrawatch-apputils\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 17.1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhosp-rhel9/osp-director-agent\",\"cpes\":[\"cpe:/a:redhat:openstack:17.1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenStack Platform 18.0\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoso-operators/sg-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:openstack:18.0\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"quay/quay-builder-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Quay 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"quay/quay-rhel8\",\"cpes\":[\"cpe:/a:redhat:quay:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/yggdrasil-worker-forwarder\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"yggdrasil-worker-forwarder\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 1\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skupper-cli\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Service Interconnect 2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"skupper-cli\",\"cpes\":[\"cpe:/a:redhat:service_interconnect:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Security Profiles Operator\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"compliance/openshift-selinuxd-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_security_profiles_operator:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Service Telemetry Framework 1.5\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"stf/sg-core-rhel9\",\"cpes\":[\"cpe:/a:redhat:stf:1.5\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"golang-github-danielqsj-kafka_exporter\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Zero Trust Workload Identity Manager - Tech Preview\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\",\"cpes\":[\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-03-10T13:32:09.097820Z\",\"id\":\"CVE-2026-27137\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-295\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:golang:go:1.26.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A40FE3CB-0D03-462B-8A19-4DF1920ABE82\"}]}]}],\"references\":[{\"url\":\"https://go.dev/cl/752182\",\"source\":\"security@golang.org\",\"tags\":[\"Mailing List\"]},{\"url\":\"https://go.dev/issue/77952\",\"source\":\"security@golang.org\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk\",\"source\":\"security@golang.org\",\"tags\":[\"Release Notes\"]},{\"url\":\"https://pkg.go.dev/vuln/GO-2026-4599\",\"source\":\"security@golang.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10125\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10158\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10169\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10175\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10184\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10225\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10250\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:10929\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:11800\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:13545\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:14879\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19022\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19049\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19132\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19181\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:19375\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:21769\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22347\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22423\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22450\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22714\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22862\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:22937\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23228\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26568\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:26585\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28038\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28047\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:29854\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36796\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:39810\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41019\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41928\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5110\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54757\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:5549\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:7291\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8151\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8167\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8337\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8338\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:8842\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9052\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9385\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9697\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9698\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9699\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:9872\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-27137\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2445345\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-20T12:07:41+00:00",
"cve": "CVE-2026-27137",
"id": "CVE-2026-27137",
"initial_release_date": "2026-03-06T21:28:13.748000+00:00",
"product_status:fixed": "360",
"product_status:known_affected": "132",
"product_status:known_not_affected": "1352",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "moderate",
"current_release_date": "2026-07-19T17:41:59Z",
"cve": "CVE-2026-27137",
"id": "CVE-2026-27137",
"initial_release_date": "2026-03-07T00:25:42Z",
"product_status:known_not_affected": "177",
"product_status:recommended": "159",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-27137",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-27137.json",
"version": "21"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"crypto/x509: Incorrect enforcement of email constraints in crypto/x509\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\", \"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.2.3-4.el10_1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"0:0.2.7-3.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhc-worker-playbook\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.25.2-3.el10_1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"delve\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.2-2.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.9.27-6.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang-github-openprinting-ipp-usb\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:165.1-2.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:52.1-1.el10_2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"image-builder\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux_eus:10.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10.0 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.2.3-4.el10_0\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhc-worker-playbook\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.26.2-1.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:165.1-2.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:52.1-1.el9_8\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"image-builder\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhel_eus:9.6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9.6 Extended Update Support\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"6:0.8.5-2.el9_6.2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.2.1-1.1.el8ost\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"collectd-sensubility\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.3.23-22.el8ost\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"etcd\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:3.4.26-9.5.el9ost\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"etcd\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Services on OpenShift 18.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:0.1.1-18.0.20260602234716.a95ae05.el9ost\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang-github-openstack-k8s-operators-os-diff\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.0 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.0.3-1.el9em\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"flightctl\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.1::el10\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.1 for RHEL 10\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.3-1.el10em\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"flightctl\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"RHEM 1.1 for RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.1.3-1.el9em\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"flightctl\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Builds for Red Hat OpenShift 1.6.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1774334066\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-builds/openshift-builds-waiters-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:devworkspace:0.40::el9\"], \"vendor\": \"Red Hat\", \"product\": \"DevWorkspace Operator 0.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776457293\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devworkspace/devworkspace-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging for Red Hat OpenShift 6.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780051640\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/eventrouter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1781192891\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/eventrouter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:6.2::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift 6.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776800087\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-logging/eventrouter-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.3.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779210675\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.4.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779838819\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Global Hub 1.6.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780320809\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779809598\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"oadp/oadp-velero-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_api_data_protection:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift API for Data Protection 1.5\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779808027\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"oadp/oadp-velero-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:acm:2.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Management for Kubernetes 2.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1774085848\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhacm2/subctl-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2.6::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2.6\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1777391542\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"ansible-automation-platform-26/receptor-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:hummingbird:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Hardened Images\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.26.2-1.hum1\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"golang1-26-main\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lightspeed_for_runtimes:1.0::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Lightspeed (formerly Insights) for Runtimes 1.0\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1.0.2-1776288486\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rh-lightspeed-runtimes/runtimes-inventory-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhmt:1.8::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Migration Toolkit 1.8\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783914276\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhmtc/openshift-migration-registry-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_globalhub:1.5::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat multicluster global hub 1.5.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1773650627\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"1779828691\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"multicluster-globalhub/multicluster-globalhub-agent-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776773362\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-rhel9-operator\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_builds:1.7::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Builds 1.7.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776846936\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-builds/openshift-builds-waiters-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.27::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.27\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776789889\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/udi-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_distributed_tracing:3.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift distributed tracing 3.9.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776435680\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhosdt/tempo-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.18::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776755965\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/dex-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.19::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.19\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776767162\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/dex-rhel8\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_gitops:1.20::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift GitOps 1.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776773421\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"openshift-gitops-1/dex-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3.16::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1779204086\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"quay/quay-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6.18::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6.18\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1778082595\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"satellite/iop-vmaas-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:trusted_artifact_signer:1.3::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Trusted Artifact Signer 1.3\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776339099\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhtas/client-server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.11::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.11\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776966691\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"web-terminal/web-terminal-exec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.12::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.12\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776959849\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"web-terminal/web-terminal-exec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.13::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.13\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776197785\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"web-terminal/web-terminal-exec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.14::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.14\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1776199398\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"web-terminal/web-terminal-exec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:webterminal:1.15::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Web Terminal 1.15\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1775672762\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"web-terminal/web-terminal-exec-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:assisted_installer:2\"], \"vendor\": \"Red Hat\", \"product\": \"Assisted Installer for Red Hat OpenShift Container Platform 2\", \"packageName\": \"rhai/assisted-installer-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cert_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"cert-manager Operator for Red Hat OpenShift\", \"packageName\": \"cert-manager/jetstack-cert-manager-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_compliance_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Compliance Operator\", \"packageName\": \"compliance/openshift-compliance-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"build-of-trustee/trustee-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:confidential_compute_attestation:1\"], \"vendor\": \"Red Hat\", \"product\": \"Confidential Compute Attestation\", \"packageName\": \"openshift-sandboxed-containers/osc-monitor-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"cryostat/cryostat-storage-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_custom_metrics_autoscaler:2\"], \"vendor\": \"Red Hat\", \"product\": \"Custom Metric Autoscaler operator for Red Hat Openshift\", \"packageName\": \"custom-metrics-autoscaler/custom-metrics-autoscaler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:deployment_validator_operator\"], \"vendor\": \"Red Hat\", \"product\": \"Deployment Validation Operator\", \"packageName\": \"dvo/deployment-validation-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ext_dns_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"ExternalDNS Operator\", \"packageName\": \"edo/external-dns-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ext_dns_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"ExternalDNS Operator\", \"packageName\": \"edo/external-dns-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:external_secrets_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"External Secrets Operator for Red Hat OpenShift\", \"packageName\": \"external-secrets-operator/external-secrets-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_far:0\"], \"vendor\": \"Red Hat\", \"product\": \"Fence Agents Remediation Operator\", \"packageName\": \"workload-availability/fence-agents-remediation-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_file_integrity_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"File Integrity Operator\", \"packageName\": \"compliance/openshift-compliance-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:gatekeeper:3\"], \"vendor\": \"Red Hat\", \"product\": \"Gatekeeper 3\", \"packageName\": \"gatekeeper/gatekeeper-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/eventrouter-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:logging:5\"], \"vendor\": \"Red Hat\", \"product\": \"Logging Subsystem for Red Hat OpenShift\", \"packageName\": \"openshift-logging/logging-loki-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/lvms-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/topolvm-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:lvms:4\"], \"vendor\": \"Red Hat\", \"product\": \"Logical Volume Manager Storage\", \"packageName\": \"lvms4/topolvm-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_mdr:0\"], \"vendor\": \"Red Hat\", \"product\": \"Machine Deletion Remediation Operator\", \"packageName\": \"workload-availability/machine-deletion-remediation-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:migration_toolkit_applications:8\"], \"vendor\": \"Red Hat\", \"product\": \"Migration Toolkit for Applications 8\", \"packageName\": \"mta/mta-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:mirror_registry:1\"], \"vendor\": \"Red Hat\", \"product\": \"mirror registry for Red Hat OpenShift\", \"packageName\": \"openshift/mirror-registry-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:mirror_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"mirror registry for Red Hat OpenShift 2\", \"packageName\": \"openshift/mirror-registry-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:multicluster_engine\"], \"vendor\": \"Red Hat\", \"product\": \"Multicluster Engine for Kubernetes\", \"packageName\": \"multicluster-engine/discovery-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:network_observ_optr:1\"], \"vendor\": \"Red Hat\", \"product\": \"Network Observability Operator\", \"packageName\": \"network-observability/network-observability-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:workload_availability_nhc:0\"], \"vendor\": \"Red Hat\", \"product\": \"Node HealthCheck Operator\", \"packageName\": \"workload-availability/node-healthcheck-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"helm\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"ocp-tools-4/jenkins-agent-base-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:ocp_tools\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Developer Tools and Services\", \"packageName\": \"ocp-tools-4/jenkins-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_lightspeed\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Lightspeed\", \"packageName\": \"openshift-lightspeed/lightspeed-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_pipelines:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Pipelines\", \"packageName\": \"openshift-pipelines-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"kn-workflow-plugin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-plugin-event-sender-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-clients\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:2\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 2\", \"packageName\": \"openshift-service-mesh/kiali-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_mesh:3\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Service Mesh 3\", \"packageName\": \"openshift-service-mesh/kiali-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_power_monitoring\"], \"vendor\": \"Red Hat\", \"product\": \"Power monitoring for Red Hat OpenShift\", \"packageName\": \"openshift-power-monitoring/kepler-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/3scale-rhel7-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp2/3scale-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp26/3scale-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_3scale_amp:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat 3scale API Management Platform 2\", \"packageName\": \"3scale-amp26/operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:advanced_cluster_security:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Advanced Cluster Security 4\", \"packageName\": \"advanced-cluster-security/rhacs-main-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"ansible-automation-platform/platform-operator-bundle\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy-openssl30\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"automation-gateway-proxy-openssl32\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.11-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.11-grpcio\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.12-galaxy-ng\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3.12-grpcio\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python3x-grpcio\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"python-grpcio\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:ansible_automation_platform:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Ansible Automation Platform 2\", \"packageName\": \"receptor\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_hawtio:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel - HawtIO 4\", \"packageName\": \"hawtio-operator-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:certifications:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Certification Program for Red Hat Enterprise Linux 9\", \"packageName\": \"redhat-certification-preflight\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:connectivity_link:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Connectivity Link 1\", \"packageName\": \"rhcl-1/coredns-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:rhdh:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Developer Hub\", \"packageName\": \"rhdh/rhdh-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:edge_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Edge Manager 1\", \"packageName\": \"rhem/flightctl-ui-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"butane\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"git-lfs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"go-fdo-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"go-fdo-server\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"grafana-pcp\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"rhc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"rhel10/bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"toolbox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"trustee\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"trustee-guest-components\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"packageName\": \"yggdrasil\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"host-metering\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"rhc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"packageName\": \"rhc-worker-script\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/containernetworking-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/runc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"container-tools:rhel8/toolbox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"git-lfs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"go-toolset:rhel8/golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"grafana-pcp\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"osbuild-composer\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"rhc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"packageName\": \"weldr-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"buildah\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"butane\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"containernetworking-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"git-lfs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"grafana-pcp\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"gvisor-tap-vsock\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"opentelemetry-collector\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"rhc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"rhel9/bootc-image-builder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"runc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"toolbox\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"trustee-guest-components\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"packageName\": \"weldr-client\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"golang\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-rhel8-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_cluster_manager_cli:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Cluster Manager CLI\", \"packageName\": \"ocm-cli-clients/ocm-cli-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"butane\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"conmon\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"conmon-rs\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"containernetworking-plugins\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"cri-o\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"cri-tools\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"golang-github-prometheus-promu\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ignition\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"kata-containers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"microshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/frr-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/frr-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift4/ose-sdn-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift-clients\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"openshift-kuryr\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-aws-ecr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-azure-acr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"ose-gcp-gcr-image-credential-provider\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"podman\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"runc\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"packageName\": \"skopeo\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_data_foundation:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Openshift Data Foundation 4\", \"packageName\": \"odf4/cephcsi-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:windows_machine_config\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift for Windows Containers\", \"packageName\": \"openshift4-wincw/windows-machine-config-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_service_on_aws:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift on AWS\", \"packageName\": \"rosa\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/virt-api\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"container-native-virtualization/virt-api-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"kubevirt\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:container_native_virtualization:4\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Virtualization 4\", \"packageName\": \"openshift-golang-builder-container\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"packageName\": \"golang-github-infrawatch-apputils\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:16.2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 16.2\", \"packageName\": \"rhosp-rhel8/osp-director-agent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"collectd-libpod-stats\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"golang-github-infrawatch-apputils\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:17.1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 17.1\", \"packageName\": \"rhosp-rhel9/osp-director-agent\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openstack:18.0\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenStack Platform 18.0\", \"packageName\": \"rhoso-operators/sg-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"packageName\": \"quay/quay-builder-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:quay:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Quay 3\", \"packageName\": \"quay/quay-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/yggdrasil-worker-forwarder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"yggdrasil-worker-forwarder\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:1\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 1\", \"packageName\": \"skupper-cli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_interconnect:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Service Interconnect 2\", \"packageName\": \"skupper-cli\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_security_profiles_operator:1\"], \"vendor\": \"Red Hat\", \"product\": \"Security Profiles Operator\", \"packageName\": \"compliance/openshift-selinuxd-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:stf:1.5\"], \"vendor\": \"Red Hat\", \"product\": \"Service Telemetry Framework 1.5\", \"packageName\": \"stf/sg-core-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"golang-github-danielqsj-kafka_exporter\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:1\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-csi-driver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:zero_trust_workload_identity_manager:0\"], \"vendor\": \"Red Hat\", \"product\": \"Zero Trust Workload Identity Manager - Tech Preview\", \"packageName\": \"zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-03-06T22:01:38.859Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-03-06T21:28:13.748Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:41019: RHEM 1.1 for RHEL 10, RHEM 1.1 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54757: Red Hat OpenStack Platform 16.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36796: RHEM 1.0 for RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28047: Red Hat OpenStack Platform 17.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:39810: 9Base-RHOSO-TOOLS-18, Red Hat OpenStack Services on OpenShift 18.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10929: Red Hat Enterprise Linux AppStream EUS (v. 10.0)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8842: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10169: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19022: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22937: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19049: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22450: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19132: Red Hat Enterprise Linux AppStream (v. 10)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28038: Red Hat Enterprise Linux AppStream EUS (v.9.6)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19181: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23228: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22714: Red Hat Enterprise Linux AppStream (v. 9)\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5549: Builds for Red Hat OpenShift 1.6.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9872: DevWorkspace Operator 0.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:11800: Logging Subsystem for Red Hat OpenShift 6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26585: Logging Subsystem for Red Hat OpenShift 6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22862: Logging for Red Hat OpenShift 6.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22423: Multicluster Global Hub 1.3.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:22347: Multicluster Global Hub 1.4.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23345: Multicluster Global Hub 1.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:29854: OpenShift API for Data Protection 1.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:26568: OpenShift API for Data Protection 1.5\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8151: Red Hat Advanced Cluster Management for Kubernetes 2.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:13545: Red Hat Ansible Automation Platform 2.6\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:7291: Red Hat Hardened Images\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9052: Red Hat Lightspeed (formerly Insights) for Runtimes 1.0\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41928: Red Hat Migration Toolkit 1.8\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10184: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10158: Red Hat OpenShift Builds 1.7.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10175: Red Hat OpenShift Dev Spaces 3.27\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9697: Red Hat OpenShift GitOps 1.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9698: Red Hat OpenShift GitOps 1.19\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9699: Red Hat OpenShift GitOps 1.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:9385: Red Hat OpenShift distributed tracing 3.9.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:19375: Red Hat Quay 3.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:14879: Red Hat Satellite 6.18\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10125: Red Hat Trusted Artifact Signer 1.3\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10250: Red Hat Web Terminal 1.11\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:10225: Red Hat Web Terminal 1.12\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8338: Red Hat Web Terminal 1.13\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8337: Red Hat Web Terminal 1.14\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:8167: Red Hat Web Terminal 1.15\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:5110: Red Hat multicluster global hub 1.5.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:21769: Red Hat multicluster global hub 1.5.1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-03-06T21:28:13.748Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-27137\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2445345\", \"name\": \"RHBZ#2445345\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27137.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41019\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54757\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36796\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28047\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:39810\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10929\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8842\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10169\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19022\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22937\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19049\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22450\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19132\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28038\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19181\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23228\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22714\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5549\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9872\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:11800\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26585\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22862\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22423\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:22347\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23345\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:29854\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:26568\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8151\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:13545\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:7291\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9052\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41928\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10184\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10158\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10175\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9697\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9698\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9699\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:9385\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:19375\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:14879\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10125\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10250\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:10225\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8338\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8337\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:8167\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:5110\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:21769\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-295\", \"description\": \"Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-20T12:31:59.833Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-27137\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-03-10T13:32:09.097820Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-03-10T13:32:37.164Z\"}}], \"cna\": {\"title\": \"Incorrect enforcement of email constraints in crypto/x509\", \"credits\": [{\"lang\": \"en\", \"value\": \"Jakub Ciolek\"}], \"affected\": [{\"vendor\": \"Go standard library\", \"product\": \"crypto/x509\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.26.0-0\", \"lessThan\": \"1.26.1\", \"versionType\": \"semver\"}], \"packageName\": \"crypto/x509\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"newEmailConstraints\"}, {\"name\": \"emailConstraints.query\"}, {\"name\": \"checkConstraints\"}, {\"name\": \"checkChainConstraints\"}, {\"name\": \"parseMailboxes\"}, {\"name\": \"Certificate.Verify\"}]}], \"references\": [{\"url\": \"https://go.dev/cl/752182\"}, {\"url\": \"https://go.dev/issue/77952\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2026-4599\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-295: Improper Certificate Validation\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2026-03-08T05:56:20.771Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-27137\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T12:31:59.833Z\", \"dateReserved\": \"2026-02-17T19:57:28.434Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2026-03-06T21:28:13.748Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
RHSA-2026:22423
Vulnerability from csaf_redhat - Published: 2026-06-02 07:42 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: Multicluster Global Hub 1.3.4 security update
Severity
Important
Notes
Topic: Multicluster Global Hub v1.3.4 general availability release images, which provide security fixes, bug fixes, and updated container images.
Red Hat Product Security has rated this update as having a security impact of Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
5.9 (Medium)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.
8.3 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting memory corruption issues. The exact method of exploitation and specific consequences would depend on the nature of the memory corruption.
8.3 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
9 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Important
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Threats
Impact
Moderate
A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 | — |
Workaround
|
Threats
Impact
Important
References
139 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.3.4 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22423",
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-21728",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32285",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33487",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33815",
"url": "https://access.redhat.com/security/cve/CVE-2026-33815"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33816",
"url": "https://access.redhat.com/security/cve/CVE-2026-33816"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41603",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41604",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41605",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41606",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41607",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41636",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43869",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22423.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.3.4 security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:37+00:00",
"generator": {
"date": "2026-08-21T17:44:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:22423",
"initial_release_date": "2026-06-02T07:42:09+00:00",
"revision_history": [
{
"date": "2026-06-02T07:42:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Multicluster Global Hub 1.3.4",
"product": {
"name": "Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.3::el9"
}
}
}
],
"category": "product_family",
"name": "Multicluster Global Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1779212259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1779210675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1779210608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3Aa1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1779925031"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Adebed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779209992"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779924243"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1779212259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1779210675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Ae8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1779210608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Adced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779209992"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779924243"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1779212259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1779210675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1779210608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779209992"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779924243"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1779212259"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1779210675"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1779210608"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779209992"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Ad5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779924243"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64 as a component of Multicluster Global Hub 1.3.4",
"product_id": "Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.3.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-21728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T09:00:58.144273+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana/tempo: Tempo: Denial of Service via large queries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "RHBZ#2461395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-21728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-21728",
"url": "https://grafana.com/security/security-advisories/cve-2026-21728"
}
],
"release_date": "2026-04-24T08:00:47.074000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grafana/tempo: Tempo: Denial of Service via large queries"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32285",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:54.925687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "RHBZ#2451846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://github.com/buger/jsonparser/issues/275",
"url": "https://github.com/buger/jsonparser/issues/275"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4514",
"url": "https://github.com/golang/vulndb/issues/4514"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4514",
"url": "https://pkg.go.dev/vuln/GO-2026-4514"
}
],
"release_date": "2026-03-26T19:40:51.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33487",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-26T18:02:32.278778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "RHBZ#2451814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc",
"url": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc"
}
],
"release_date": "2026-03-26T17:17:51.101000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue"
},
{
"cve": "CVE-2026-33815",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T16:01:25.130006+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455975"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33815"
},
{
"category": "external",
"summary": "RHBZ#2455975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455975"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33815",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33815"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33815",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33815"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4771",
"url": "https://pkg.go.dev/vuln/GO-2026-4771"
}
],
"release_date": "2026-04-07T15:19:24.344000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability"
},
{
"cve": "CVE-2026-33816",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-07T16:01:14.142946+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455972"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/jackc/pgx, a PostgreSQL driver for Go. This memory-safety vulnerability could allow an attacker to cause various impacts, such as denial of service (DoS) or potentially arbitrary code execution, by exploiting memory corruption issues. The exact method of exploitation and specific consequences would depend on the nature of the memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33816"
},
{
"category": "external",
"summary": "RHBZ#2455972",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455972"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33816",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33816"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33816",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33816"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4772",
"url": "https://pkg.go.dev/vuln/GO-2026-4772"
}
],
"release_date": "2026-04-07T15:19:24.529000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-41602",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:16.099816+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "RHBZ#2463407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:06.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
},
{
"cve": "CVE-2026-41603",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-04-28T10:01:29.782287+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463411"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "RHBZ#2463411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/7",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:40.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation"
},
{
"cve": "CVE-2026-41604",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:47.903741+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "RHBZ#2463416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41604"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/5",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/5"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:13.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41605",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:54.269412+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463418"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "RHBZ#2463418",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/4",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:44.319000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability"
},
{
"cve": "CVE-2026-41606",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-04-28T10:01:19.136351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "RHBZ#2463408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/3",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:12.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion"
},
{
"cve": "CVE-2026-41607",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:33.022623+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463412"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "RHBZ#2463412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/2",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/2"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:48.502000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41636",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-04-28T10:01:03.992199+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463404"
}
],
"notes": [
{
"category": "description",
"text": "Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "RHBZ#2463404",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463404"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/1",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:22:14.639000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion"
},
{
"cve": "CVE-2026-43869",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-05T08:00:56.417384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "RHBZ#2466660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r",
"url": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r"
}
],
"release_date": "2026-05-05T07:25:48.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T07:42:09+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.12/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22423"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:031c9b259f062e07131ae61ad1b354b9362e768fe14bdd1794754e83424f4a20_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:03b18d051be128024f03df408069e5ad2346a2799115a4e13ad7cb394daabe3b_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:6fb8506afd2e5f295305dc044e86a3059c1c91052715079388f2ea54a746fb38_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:823597446afec693451e47ebf73fd61d625e6fc327970340d4226b26a71f4707_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:1128dffb3133bd5dc86dd3e4d74d807aa3567acf7d9eaf8c94cb522efb2c39ec_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:61e24ffe7c4bf801e8ca4650befe3e6bc99235f31445d76d790bab3026ead0ff_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:830a5fffea2982f059927ae3eb9dbe474a4d830175395e1dd32800d08304bc22_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9db7d9dc19cb6cf1392ea70441d1eb98535f9cfeb478230156ab11f556657b02_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7a1cd2f61dfac63ccec20638eed4ad39b8a3a0d5d78bd68345885af030a1af0b_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:7b3abb4db8da02cb6c51b78fa7b8ee19cf0f9640902a5925a7bc2c41d6d25d69_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:9ba27f8af737cbe4eb46bf62cdb56e4582ed15640046cf741a062a9702c83a32_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:e8d3ee3bc0d99e38df6c617793c517be7261cce2855926a53ab10b42e989bdfd_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:a1d22f270c8e8b6fdb8324bf13b116382c0364058f28ba043128b93772ff33d3_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:0d265ad57e771cf3403b59e030e8e47e4c439c0d300721944ba8ca89ed8d0817_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:2e19aabfe25fff53230af0e6236eb19ca44004f47e1ebfe9add5acf9ba3ba525_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:9438798cc9dfaf0d93675dd5a6cf1162ff8025f49ab162374e74dffa67f4c1ee_amd64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:d5ebd2285f925a5d6efb9bf712ee41aa45dc4cce7ff50a0aca83da5155d4aa8c_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:2b952d5fb1960f40a3f05b351f958829b3a61a31fce495a3af751a063929889d_arm64",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:324b21e3ef94225610d57090e1e05617ae46f4fc536bdcec5d3975c5fc44bb6e_s390x",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:dced1f854c7f823c247d35ac265da3994d5dda70fa4829ec91fa49295966c84f_ppc64le",
"Multicluster Global Hub 1.3.4:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:debed0fd65dfd3106368fbdad8a3730888c73ffca97a009054a0f2a64bd6ef8c_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation"
}
]
}
RHSA-2026:22450
Vulnerability from csaf_redhat - Published: 2026-06-02 11:22 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: osbuild-composer security update
Severity
Important
Notes
Topic: An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)
* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
93 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22450",
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-179244",
"url": "https://issues.redhat.com/browse/RHEL-179244"
},
{
"category": "external",
"summary": "RHEL-180005",
"url": "https://issues.redhat.com/browse/RHEL-180005"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22450.json"
}
],
"title": "Red Hat Security Advisory: osbuild-composer security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:37+00:00",
"generator": {
"date": "2026-08-21T17:44:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:22450",
"initial_release_date": "2026-06-02T11:22:13+00:00",
"revision_history": [
{
"date": "2026-06-02T11:22:13+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-02T11:22:13+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el10_2.src",
"product": {
"name": "osbuild-composer-0:165.1-2.el10_2.src",
"product_id": "osbuild-composer-0:165.1-2.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-core-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src"
},
"product_reference": "osbuild-composer-0:165.1-2.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-02T11:22:13+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22450"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.src",
"AppStream-10.2.Z:osbuild-composer-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-core-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-debugsource-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-tests-debuginfo-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-0:165.1-2.el10_2.x86_64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.aarch64",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.ppc64le",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.s390x",
"AppStream-10.2.Z:osbuild-composer-worker-debuginfo-0:165.1-2.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:22714
Vulnerability from csaf_redhat - Published: 2026-06-03 08:19 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: osbuild-composer security update
Severity
Important
Notes
Topic: An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)
* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
33 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
93 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.\n\nSecurity Fix(es):\n\n* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22714",
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-179251",
"url": "https://issues.redhat.com/browse/RHEL-179251"
},
{
"category": "external",
"summary": "RHEL-180018",
"url": "https://issues.redhat.com/browse/RHEL-180018"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22714.json"
}
],
"title": "Red Hat Security Advisory: osbuild-composer security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:41+00:00",
"generator": {
"date": "2026-08-21T17:44:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:22714",
"initial_release_date": "2026-06-03T08:19:01+00:00",
"revision_history": [
{
"date": "2026-06-03T08:19:01+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T08:19:01+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.src",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.src",
"product_id": "osbuild-composer-0:165.1-2.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debugsource@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-core-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-tests-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product_id": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/osbuild-composer-worker-debuginfo@165.1-2.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
},
"product_reference": "osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-61728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:39.965024+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434431"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the archive/zip package in the Go standard library. A super-linear file name indexing algorithm is used in the first time a file in an archive is opened. A crafted zip archive containing a specific arrangement of file names can cause an excessive CPU and memory consumption. A Go application processing a malicious archive can become unresponsive or crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker needs to be able to process a malicious zip archive with an application using the archive/zip package. Additionally, this vulnerability can cause a Go application to consume an excessive amount of CPU and memory, eventually resulting in a denial of service with no other security impact. Due to these reasons, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61728"
},
{
"category": "external",
"summary": "RHBZ#2434431",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434431"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61728",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61728"
},
{
"category": "external",
"summary": "https://go.dev/cl/736713",
"url": "https://go.dev/cl/736713"
},
{
"category": "external",
"summary": "https://go.dev/issue/77102",
"url": "https://go.dev/issue/77102"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4342",
"url": "https://pkg.go.dev/vuln/GO-2026-4342"
}
],
"release_date": "2026-01-28T19:30:31.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement a timeout in your archive/zip processing logic to abort the operation if it exceeds a few seconds, preventing the application from consuming an excessive amount of resources.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T08:19:01+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22714"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-core-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-debugsource-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-tests-debuginfo-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-0:165.1-2.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:osbuild-composer-worker-debuginfo-0:165.1-2.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:22862
Vulnerability from csaf_redhat - Published: 2026-06-03 14:28 - Updated: 2026-08-21 17:12Summary
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.5
Severity
Important
Notes
Topic: Logging for Red Hat OpenShift - 6.4.5
Details: Red Hat OpenShift Logging 6.4.5 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.
5.3 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Workaround
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Workaround
|
Threats
Impact
Moderate
lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 "match copy operations," allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — |
Threats
Impact
Important
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x | — | ||
| Unresolved product id: Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 | — |
Threats
Impact
Important
References
67 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Logging for Red Hat OpenShift - 6.4.5",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Logging 6.4.5 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22862",
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-31812",
"url": "https://access.redhat.com/security/cve/CVE-2026-31812"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32829",
"url": "https://access.redhat.com/security/cve/CVE-2026-32829"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22862.json"
}
],
"title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.4.5",
"tracking": {
"current_release_date": "2026-08-21T17:12:10+00:00",
"generator": {
"date": "2026-08-21T17:12:10+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:22862",
"initial_release_date": "2026-06-03T14:28:38+00:00",
"revision_history": [
{
"date": "2026-06-03T14:28:38+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:12:10+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Logging for Red Hat OpenShift 6.4",
"product": {
"name": "Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:logging:6.4::el9"
}
}
}
],
"category": "product_family",
"name": "Logging for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3Aed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-operator-bundle@sha256%3A2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=1780055531"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Af88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-operator-bundle@sha256%3A236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=1780055542"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ab150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Afac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Ae4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ab1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Ad840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3Aec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Ab3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Aee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Af2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1780051689"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Acbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1780051630"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1780051809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1780051656"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1780051644"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3A287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1780051640"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Aba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1780052069"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64 as a component of Logging for Red Hat OpenShift 6.4",
"product_id": "Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64",
"relates_to_product_reference": "Logging for Red Hat OpenShift 6.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-31812",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-03-10T23:02:15.752133+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2446330"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in quinn-proto, a pure-Rust implementation of the IETF QUIC transport protocol. A remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The availability impact of this flaw is limited to specific services on Red Hat systems. Host system availability is not at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-31812"
},
{
"category": "external",
"summary": "RHBZ#2446330",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2446330"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-31812",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-31812"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-31812",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31812"
},
{
"category": "external",
"summary": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98",
"url": "https://github.com/quinn-rs/quinn/security/advisories/GHSA-6xvm-j4wr-6v98"
}
],
"release_date": "2026-03-10T21:04:36.812000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "quinn-proto: quinn-proto: Denial of Service via crafted QUIC Initial packet"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32829",
"cwe": {
"id": "CWE-823",
"name": "Use of Out-of-range Pointer Offset"
},
"discovery_date": "2026-03-16T22:05:38.553414+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448271"
}
],
"notes": [
{
"category": "description",
"text": "lz4_flex is a pure Rust implementation of LZ4 compression/decompression. In versions 0.11.5 and below, and 0.12.0, decompressing invalid LZ4 data can leak sensitive information from uninitialized memory or from previous decompression operations. The library fails to properly validate offset values during LZ4 \"match copy operations,\" allowing out-of-bounds reads from the output buffer. The block-based API functions (`decompress_into`, `decompress_into_with_dict`, and others when `safe-decode` is disabled) are affected, while all frame APIs are unaffected. The impact is potential exposure of sensitive data and secrets through crafted or malformed LZ4 input. This issue has been fixed in versions 0.11.6 and 0.12.1.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "lz4_flex: lz4_flex\u0027s decompression can leak information from uninitialized memory or reused output buffer",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In RHEL 9 and RHEL 10, this vulnerability presents minimal risk as the rust-analyzer component operates in a \"closed loop,\" strictly decompressing its own internal database. Because it does not process external or untrusted data, exploitation requires an attacker to already possess local access and sufficient privileges to tamper with the internal cache files on disk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32829"
},
{
"category": "external",
"summary": "RHBZ#2448271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32829",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32829"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32829",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32829"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex",
"url": "https://github.com/PSeitz/lz4_flex"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d",
"url": "https://github.com/PSeitz/lz4_flex/commit/055502ee5d297ecd6bf448ac91c055c7f6df9b6d"
},
{
"category": "external",
"summary": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv",
"url": "https://github.com/PSeitz/lz4_flex/security/advisories/GHSA-vvp9-7p8x-rfvv"
}
],
"release_date": "2026-03-16T20:48:08+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "lz4_flex: lz4_flex\u0027s decompression can leak information from uninitialized memory or reused output buffer"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"known_not_affected": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T14:28:38+00:00",
"details": "For OpenShift Container Platform 4.20 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.20/html/release_notes/ocp-4-20-release-notes\n\nFor Red Hat OpenShift Logging 6.4, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.4",
"product_ids": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22862"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:2bce5cfd48129d7b7754573fb47cb9270f25b39d12d2219734c77e999ddf3d29_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:0d3749fd70dc3cddf9fd2d778c2e665c4b67ce31c45b714d38e32af0b31e580d_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:15de420e2672e785da00ab02631f7114ea139c3938acf7f710b753c4047e4dc9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:67e812457329a99f8c269cfeb815df6d904b65a29e3bcd0e0edd538cbb53bcf4_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:ed33a9c93ef3846acd2f5db2531275566272c9d289d3155d3c9350c392f05356_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:098c88aa165426fc42a8ed1c2730eaeeea973acf1dc4448d72d4fa8cff1c433b_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:0a6bb7af1977294b71519115ccc42e59653ec12479ebf0b3af81f7d24bf46da1_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:61b62441c88e85f877e876a5ecc95c32d0faba813b708f9d1db759dce5385798_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9f345c47dd532864c1413308dbae6dd5de08137f87fced025d2047ae8939a492_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:0137e7a64ee09dcfd28f3f14202242b31d102c125a141a36df93784e4094aacf_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:2ff96f6e5c4e642f639df37cedfdd8ffd34e203e8cd06921af0c02f647496212_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:cbdfe1e832575a8fffd5a9759078725c00161a098c693b43ff42bcfce8afbd05_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d840cf730b13b0a36340b180863a2fbcf0d7b6f1e953481a24fadbc9b3fd07c9_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:587c7963571af01291ea01563c426a93d77a77ef22b79641fddbc9833791bff7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:681a30a4d5f06811095d4d2d60c26be71be64d0fdf1f73de4ef03d11df125291_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:89af60956e8a9edffd4da720bb312780cc8df816dcdb3c42f9692a6a18b2f009_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:ec5351b18b95ae528f39f28e0ee4469f5e5b57544499c596ca07236084b2dcf4_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:236c1feeeaec558b78611f2b599c8554639e7d6667bdd664bef2fc9ff1b86093_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:465e6c0a23afe7551b3a0522a8e7ed7519b93a94ef11ccdb41d034adbbc8f7f9_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:4b98fca26d5a72afbae2a15869fe0c0320d7ff5bbb9934e641be6536ed8387af_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:b3f5cfe39e28e525f1329d5a49307f8b0c48da0c29cb52be7fe98199c62d40ec_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f88441adcde4ec537cf76021824a8007c42c4ecefffff310e5c5f2117824bb79_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:2bcb9fd79a9591c1e00c40d5e123ca027391072f91c3dc598acad5b169528797_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:84a61cc3d10c90399780ba85d120f4a49f8393500a12eb2fd7a8943b4cbdb352_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:95a10b681f0e2e0c8a889836ca7be8e8a621713e271fbfdcd3b4227d8d49d07a_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:e4f738a3fafa98b23ce46210c11a7d79d6a95244b9ec635bb4bd88623f193954_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:287d83e470aa60a068613952a14bcc2718038ca1ee52798185e55ee365a129c8_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b150b15286bda982d5dce2e68dd4bfae007eb10d51c785ff214ca9c3f6db64ea_amd64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:b1b2e6eb05040c21c81a83912b8658e57c03a7e455384ed14f86819bb978a5b6_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ee25673121b321d6f79982333dea1b656a315b5a825d5019fa093a36cdd81dd0_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:3176f479ec53def3156169e601b336dc27e1e9684969f793a5b672d8954db9a7_arm64",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:ba3685a116c66d18d1cdd49bbbf18386365b543775b711d29d8ccd4937884f04_ppc64le",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:f2d2027264fab22aae64f9e9db1a8faaaca948fd65215c3c4dbcbb8bfc362558_s390x",
"Logging for Red Hat OpenShift 6.4:registry.redhat.io/openshift-logging/vector-rhel9@sha256:fac56a57019df1c8e23c930f456ae1f6e2166139da5ee54be53cb0530931a816_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
}
]
}
RHSA-2026:22937
Vulnerability from csaf_redhat - Published: 2026-06-03 19:03 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: image-builder security update
Severity
Important
Notes
Topic: An update for image-builder is now available for Red Hat Enterprise Linux 10.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.
Security Fix(es):
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for image-builder is now available for Red Hat Enterprise Linux 10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:22937",
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-179248",
"url": "https://issues.redhat.com/browse/RHEL-179248"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_22937.json"
}
],
"title": "Red Hat Security Advisory: image-builder security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:43+00:00",
"generator": {
"date": "2026-08-21T17:44:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:22937",
"initial_release_date": "2026-06-03T19:03:32+00:00",
"revision_history": [
{
"date": "2026-06-03T19:03:32+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-03T19:03:32+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:10.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.src",
"product": {
"name": "image-builder-0:52.1-1.el10_2.src",
"product_id": "image-builder-0:52.1-1.el10_2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el10_2?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product_id": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el10_2?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.src as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src"
},
"product_reference": "image-builder-0:52.1-1.el10_2.src",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.s390x as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.s390x",
"relates_to_product_reference": "AppStream-10.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el10_2.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 10)",
"product_id": "AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el10_2.x86_64",
"relates_to_product_reference": "AppStream-10.2.Z"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-03T19:03:32+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:22937"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.src",
"AppStream-10.2.Z:image-builder-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debuginfo-0:52.1-1.el10_2.x86_64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.aarch64",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.ppc64le",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.s390x",
"AppStream-10.2.Z:image-builder-debugsource-0:52.1-1.el10_2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:23228
Vulnerability from csaf_redhat - Published: 2026-06-04 13:27 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: image-builder security update
Severity
Important
Notes
Topic: An update for image-builder is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.
Security Fix(es):
* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)
* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.
7.4 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
69 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for image-builder is now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.\n\nSecurity Fix(es):\n\n* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)\n\n* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)\n\n* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)\n\n* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23228",
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "RHEL-141689",
"url": "https://issues.redhat.com/browse/RHEL-141689"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23228.json"
}
],
"title": "Red Hat Security Advisory: image-builder security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:43+00:00",
"generator": {
"date": "2026-08-21T17:44:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:23228",
"initial_release_date": "2026-06-04T13:27:44+00:00",
"revision_history": [
{
"date": "2026-06-04T13:27:44+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-04T13:27:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product": {
"name": "Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:enterprise_linux:9::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.src",
"product": {
"name": "image-builder-0:52.1-1.el9_8.src",
"product_id": "image-builder-0:52.1-1.el9_8.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=aarch64"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=aarch64"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=ppc64le"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=ppc64le"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "image-builder-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder@52.1-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debugsource@52.1-1.el9_8?arch=s390x"
}
}
},
{
"category": "product_version",
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product_id": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/image-builder-debuginfo@52.1-1.el9_8?arch=s390x"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.src as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src"
},
"product_reference": "image-builder-0:52.1-1.el9_8.src",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.aarch64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.s390x as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.s390x",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "image-builder-debugsource-0:52.1-1.el9_8.x86_64 as a component of Red Hat Enterprise Linux AppStream (v. 9)",
"product_id": "AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
},
"product_reference": "image-builder-debugsource-0:52.1-1.el9_8.x86_64",
"relates_to_product_reference": "AppStream-9.8.0.Z.MAIN.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-61726",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-01-28T20:01:42.791305+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2434432"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: net/url: Memory exhaustion in query parameter parsing in net/url",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be able to send a specially crafted HTTP request to an application parsing URL-encoded forms with net/url, specifically a request containing a large number of unique query parameters. The request will cause the application to consume an excessive amount of memory and eventually result in a denial of service, with no impact to confidentiality or integrity. Due to this reason, this vulnerability has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-61726"
},
{
"category": "external",
"summary": "RHBZ#2434432",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2434432"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-61726",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-61726"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61726"
},
{
"category": "external",
"summary": "https://go.dev/cl/736712",
"url": "https://go.dev/cl/736712"
},
{
"category": "external",
"summary": "https://go.dev/issue/77101",
"url": "https://go.dev/issue/77101"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc",
"url": "https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4341",
"url": "https://pkg.go.dev/vuln/GO-2026-4341"
}
],
"release_date": "2026-01-28T19:30:31.215000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "golang: net/url: Memory exhaustion in query parameter parsing in net/url"
},
{
"cve": "CVE-2025-68121",
"discovery_date": "2026-02-05T18:01:30.086058+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2437111"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the crypto/tls component. This vulnerability occurs during Transport Layer Security (TLS) session resumption when certificate authority (CA) settings are modified between the initial and resumed handshakes. An attacker could exploit this to bypass certificate validation, allowing a client or server to establish a connection that should have been rejected. This could lead to an authentication bypass under specific conditions.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is a moderate flaw because it only occurs under specific conditions, such as TLS session resumption with runtime changes to certificate authority settings. Exploitation is not straightforward and requires a controlled setup. The impact is limited to certificate validation within the same component and does not affect system availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-68121"
},
{
"category": "external",
"summary": "RHBZ#2437111",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2437111"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-68121",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-68121"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68121"
},
{
"category": "external",
"summary": "https://go.dev/cl/737700",
"url": "https://go.dev/cl/737700"
},
{
"category": "external",
"summary": "https://go.dev/issue/77217",
"url": "https://go.dev/issue/77217"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk",
"url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4337",
"url": "https://pkg.go.dev/vuln/GO-2026-4337"
}
],
"release_date": "2026-02-05T17:48:44.141000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T13:27:44+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23228"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.src",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debuginfo-0:52.1-1.el9_8.x86_64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.aarch64",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.ppc64le",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.s390x",
"AppStream-9.8.0.Z.MAIN.EUS:image-builder-debugsource-0:52.1-1.el9_8.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:23345
Vulnerability from csaf_redhat - Published: 2026-06-04 14:16 - Updated: 2026-08-21 17:44Summary
Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update
Severity
Important
Notes
Topic: Multicluster Global Hub v1.6.2 general availability release images, which provide security fixes, bug fixes, and updated container images.
Red Hat Product Security has rated this update as having a security impact of Important.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.
Details: Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
No description is available for this CVE.
CWE-129 - Improper Validation of Array IndexAffected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker can exploit this vulnerability before authentication by sending a specially crafted WebSockets frame. This missing sanity check can trigger a server panic, leading to a Denial of Service (DoS) for affected deployments that use WebSockets and expose the network port to untrusted endpoints.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server. A remote attacker can exploit this vulnerability by connecting to a NATS-Server instance where the 'leafnode' configuration is enabled and compression is active. This pre-authentication flaw allows the attacker to trigger a server crash, resulting in a Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a "slice bounds out of range panic", resulting in a Denial of Service (DoS) for the affected application.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server. A remote attacker could exploit this vulnerability by manipulating MQTT (Message Queuing Telemetry Transport) Client IDs. This malfeasance allows for the hijacking of client sessions and messages. This could lead to unauthorized access to sensitive information or disruption of service.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Moderate
A flaw was found in NATS-Server, a high-performance server for the NATS.io messaging system. For MQTT deployments utilizing usercodes and passwords, the MQTT passwords were mistakenly categorized as non-authenticating identity statements (JSON Web Tokens - JWT). This misclassification leads to the exposure of these passwords through monitoring endpoints, enabling an attacker with access to these endpoints to gain sensitive information.
8.6 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server. When Access Control Lists (ACLs) were configured for message subjects, these controls were not correctly applied within the `$MQTT.>` namespace. This oversight allows MQTT clients to bypass the intended ACL checks, potentially granting unauthorized access to sensitive message subjects. This vulnerability could lead to information disclosure or unauthorized message manipulation.
8.1 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker, by connecting to the leafnode port and sending a specially crafted malformed message before authentication, can cause the nats-server to crash. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server. A malicious client connecting to the WebSockets port can cause unbounded memory use before authentication by sending a large amount of data. This resource exhaustion vulnerability can lead to a Denial of Service (DoS) for the server, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in NATS-Server. If the NATS-Server is configured with static credentials provided through command-line arguments (argv) and the monitoring port is enabled, a remote attacker with access to the monitoring port can view these credentials. The /debug/vars endpoint on the monitoring port exposes an unredacted copy of the command-line arguments, leading to information disclosure of sensitive authentication details.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in etcd, a distributed key-value store. Unauthorized users can bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients. This allows them to access sensitive cluster topology information, disrupt operations through alarms, interfere with lease management, and trigger data compaction, leading to permanent data loss and disruption of critical workflows. This vulnerability can result in information disclosure and denial of service.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service (DoS).
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Moderate
A flaw was found in Moby, an open-source container framework. This vulnerability allows for a privilege validation bypass during `docker plugin install`. Due to an error in the daemon's privilege comparison logic, the system may incorrectly accept a plugin's requested privileges that differ from those approved by the user. This could lead to unauthorized privilege escalation for installed plugins.
8.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system's integrity and confidentiality.
8.4 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering as HTML. A remote attacker could exploit this vulnerability by providing a specially crafted malformed input. Specifically, input containing a '<' character not followed by a '>' character, when processed by the SmartypantsRenderer, can lead to an out-of-bounds read or a panic. This can result in a denial of service (DoS) for the application, making it unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.
7.7 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.
9.1 (Critical)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Important
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — | ||
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Threats
Impact
Moderate
A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.
7.3 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
17 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x | — |
Workaround
|
Threats
Impact
Important
References
252 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Multicluster Global Hub v1.6.2 general availability release images, which provide security fixes, bug fixes, and updated container images.\n\nRed Hat Product Security has rated this update as having a security impact of Important. \nA Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat multicluster global hub is a set of components that enable you to import one or more hub clusters and manage them from a single hub cluster.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23345",
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-21728",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27889",
"url": "https://access.redhat.com/security/cve/CVE-2026-27889"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29785",
"url": "https://access.redhat.com/security/cve/CVE-2026-29785"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32283",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32285",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32286",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33215",
"url": "https://access.redhat.com/security/cve/CVE-2026-33215"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33216",
"url": "https://access.redhat.com/security/cve/CVE-2026-33216"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33217",
"url": "https://access.redhat.com/security/cve/CVE-2026-33217"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33218",
"url": "https://access.redhat.com/security/cve/CVE-2026-33218"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33219",
"url": "https://access.redhat.com/security/cve/CVE-2026-33219"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33247",
"url": "https://access.redhat.com/security/cve/CVE-2026-33247"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33413",
"url": "https://access.redhat.com/security/cve/CVE-2026-33413"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33487",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33813",
"url": "https://access.redhat.com/security/cve/CVE-2026-33813"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33997",
"url": "https://access.redhat.com/security/cve/CVE-2026-33997"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34040",
"url": "https://access.redhat.com/security/cve/CVE-2026-34040"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-40890",
"url": "https://access.redhat.com/security/cve/CVE-2026-40890"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41602",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41603",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41604",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41605",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41606",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41607",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41636",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43869",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-4427",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23345.json"
}
],
"title": "Red Hat Security Advisory: Multicluster Global Hub 1.6.2 security update",
"tracking": {
"current_release_date": "2026-08-21T17:44:45+00:00",
"generator": {
"date": "2026-08-21T17:44:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:23345",
"initial_release_date": "2026-06-04T14:16:54+00:00",
"revision_history": [
{
"date": "2026-06-04T14:16:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:44:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Multicluster Global Hub 1.6.2",
"product": {
"name": "Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:multicluster_globalhub:1.6::el9"
}
}
}
],
"category": "product_family",
"name": "Multicluster Global Hub"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-operator-bundle@sha256%3A51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle\u0026tag=1780370487"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e?arch=amd64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Aa1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Ad8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831?arch=ppc64le\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3A564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3A2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3Af9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3Aff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1?arch=s390x\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-grafana-rhel9@sha256%3A11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9\u0026tag=1780167118"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-agent-rhel9@sha256%3Aba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9\u0026tag=1780320809"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-manager-rhel9@sha256%3Af2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9\u0026tag=1780321673"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-rhel9-operator@sha256%3A262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator\u0026tag=1779839087"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product_id": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-globalhub-postgres-exporter-rhel9@sha256%3A556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6?arch=arm64\u0026repository_url=registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9\u0026tag=1779839762"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64 as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x as a component of Multicluster Global Hub 1.6.2",
"product_id": "Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
},
"product_reference": "registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x",
"relates_to_product_reference": "Multicluster Global Hub 1.6.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-4427",
"cwe": {
"id": "CWE-129",
"name": "Improper Validation of Array Index"
},
"discovery_date": "2026-03-18T14:02:19.414820+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2448626"
}
],
"notes": [
{
"category": "description",
"text": "No description is available for this CVE.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This CVE has been marked as Rejected by the assigning CNA.",
"title": "Statement"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-4427"
},
{
"category": "external",
"summary": "RHBZ#2448626",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448626"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-4427",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-4427"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4427"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgproto3",
"url": "https://github.com/jackc/pgproto3"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx",
"url": "https://securityinfinity.com/research/memory-safety-vulnerabilities-in-go-postgresql-wire-protocol-parsers-pgproto3-pgx"
}
],
"release_date": "2026-03-18T13:00:31+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"title": "github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message"
},
{
"cve": "CVE-2026-21728",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-24T09:00:58.144273+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461395"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tempo. A remote attacker can exploit this vulnerability by sending large queries to the Tempo service. This can lead to excessive memory allocations, potentially causing a Denial of Service (DoS) by impacting the availability of the service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grafana/tempo: Tempo: Denial of Service via large queries",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-21728"
},
{
"category": "external",
"summary": "RHBZ#2461395",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461395"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-21728",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-21728"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21728"
},
{
"category": "external",
"summary": "https://grafana.com/security/security-advisories/cve-2026-21728",
"url": "https://grafana.com/security/security-advisories/cve-2026-21728"
}
],
"release_date": "2026-04-24T08:00:47.074000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grafana/tempo: Tempo: Denial of Service via large queries"
},
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-27889",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-25T20:01:58.261703+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451447"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker can exploit this vulnerability before authentication by sending a specially crafted WebSockets frame. This missing sanity check can trigger a server panic, leading to a Denial of Service (DoS) for affected deployments that use WebSockets and expose the network port to untrusted endpoints.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27889"
},
{
"category": "external",
"summary": "RHBZ#2451447",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451447"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27889",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27889"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27889",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27889"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-03.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-03.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-pq2q-rcw4-3hr6"
}
],
"release_date": "2026-03-25T19:36:36.370000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed WebSockets frame"
},
{
"cve": "CVE-2026-29785",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-03-25T20:01:35.121898+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451444"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A remote attacker can exploit this vulnerability by connecting to a NATS-Server instance where the \u0027leafnode\u0027 configuration is enabled and compression is active. This pre-authentication flaw allows the attacker to trigger a server crash, resulting in a Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29785"
},
{
"category": "external",
"summary": "RHBZ#2451444",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451444"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29785",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29785"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29785",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29785"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-04.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-04.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8",
"url": "https://github.com/nats-io/nats-server/commit/a1488de6f2ba6e666aef0f9cce0016f7f167d6a8"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-52jh-2xxh-pwh6"
}
],
"release_date": "2026-03-25T19:38:44.587000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via leafnode compression"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
},
{
"cve": "CVE-2026-32285",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:54.925687+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451846"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/buger/jsonparser. The Delete function, when processing malformed JSON input, fails to properly validate offsets. This vulnerability can lead to a negative slice index and a runtime panic, allowing a remote attacker to cause a denial of service (DoS) by providing specially crafted JSON data.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32285"
},
{
"category": "external",
"summary": "RHBZ#2451846",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451846"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32285",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32285"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32285"
},
{
"category": "external",
"summary": "https://github.com/buger/jsonparser/issues/275",
"url": "https://github.com/buger/jsonparser/issues/275"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4514",
"url": "https://github.com/golang/vulndb/issues/4514"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4514",
"url": "https://pkg.go.dev/vuln/GO-2026-4514"
}
],
"release_date": "2026-03-26T19:40:51.837000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/buger/jsonparser: github.com/buger/jsonparser: Denial of Service via malformed JSON input"
},
{
"cve": "CVE-2026-32286",
"cwe": {
"id": "CWE-1285",
"name": "Improper Validation of Specified Index, Position, or Offset in Input"
},
"discovery_date": "2026-03-26T20:01:59.226117+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451847"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the DataRow.Decode function within the github.com/jackc/pgproto3/v2 component. A malicious or compromised PostgreSQL server can exploit this by sending a DataRow message containing a negative field length. This improper validation of field lengths leads to a \"slice bounds out of range panic\", resulting in a Denial of Service (DoS) for the affected application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The PostgreSQL server multicluster-globalhub-manager connects to is either provisioned by the operator itself or specified by the admin managing the deployment. To successfully exploit the vulnerability in this context the attacker would need to compromise the operator-deployed PostgreSQL server to force a crafted malicious DataRow message or they would need to have the privileges required to modify the operator-provisioned deployment or configure globalhub-manager to use a compromised/malicious \u201cBYO Postgres\u201d server.\n\nThe first scenario (compromising a legitimate PostgreSQL server) would change Attack Complexity from Low to High resulting in an adjusted CVSS v3.1 score of 5.9 (Moderate)\nThe other scenarios (manipulating the operator provisioned-deployment or configuring the globalhub-manager to use a malicious server) would maintain AC:L but would require privileged access. This would change Privileges Required from None to High resulting in an adjusted CVSS v3.1 score of 4.9 (Moderate)\n\nBased on the above the Impact Rating for multicluster-globalhub-manager-rhel9 is Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32286"
},
{
"category": "external",
"summary": "RHBZ#2451847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451847"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32286",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32286"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32286"
},
{
"category": "external",
"summary": "https://github.com/golang/vulndb/issues/4518",
"url": "https://github.com/golang/vulndb/issues/4518"
},
{
"category": "external",
"summary": "https://github.com/jackc/pgx/issues/2507",
"url": "https://github.com/jackc/pgx/issues/2507"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4518",
"url": "https://pkg.go.dev/vuln/GO-2026-4518"
}
],
"release_date": "2026-03-26T19:40:51.974000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33215",
"cwe": {
"id": "CWE-290",
"name": "Authentication Bypass by Spoofing"
},
"discovery_date": "2026-03-24T22:01:19.032191+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451021"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A remote attacker could exploit this vulnerability by manipulating MQTT (Message Queuing Telemetry Transport) Client IDs. This malfeasance allows for the hijacking of client sessions and messages. This could lead to unauthorized access to sensitive information or disruption of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33215"
},
{
"category": "external",
"summary": "RHBZ#2451021",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451021"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33215",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33215"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33215",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33215"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-06.tx",
"url": "https://advisories.nats.io/CVE/secnote-2026-06.tx"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-fcjp-h8cc-6879"
}
],
"release_date": "2026-03-24T20:55:53.455000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nats-server: NATS-Server: Session and message hijacking via MQTT Client ID malfeasance"
},
{
"cve": "CVE-2026-33216",
"cwe": {
"id": "CWE-213",
"name": "Exposure of Sensitive Information Due to Incompatible Policies"
},
"discovery_date": "2026-03-25T20:02:03.000174+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451448"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance server for the NATS.io messaging system. For MQTT deployments utilizing usercodes and passwords, the MQTT passwords were mistakenly categorized as non-authenticating identity statements (JSON Web Tokens - JWT). This misclassification leads to the exposure of these passwords through monitoring endpoints, enabling an attacker with access to these endpoints to gain sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33216"
},
{
"category": "external",
"summary": "RHBZ#2451448",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451448"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33216",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33216"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33216",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33216"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-05.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-05.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099",
"url": "https://github.com/nats-io/nats-server/commit/b5b63cfc35a57075e09c1f57503d31721bed8099"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-v722-jcv5-w7mc"
}
],
"release_date": "2026-03-25T19:41:55.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Information disclosure of MQTT passwords through monitoring endpoints"
},
{
"cve": "CVE-2026-33217",
"cwe": {
"id": "CWE-425",
"name": "Direct Request (\u0027Forced Browsing\u0027)"
},
"discovery_date": "2026-03-25T20:01:47.815937+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451446"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. When Access Control Lists (ACLs) were configured for message subjects, these controls were not correctly applied within the `$MQTT.\u003e` namespace. This oversight allows MQTT clients to bypass the intended ACL checks, potentially granting unauthorized access to sensitive message subjects. This vulnerability could lead to information disclosure or unauthorized message manipulation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33217"
},
{
"category": "external",
"summary": "RHBZ#2451446",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451446"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33217",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33217"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33217",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33217"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-07.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-07.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-jxxm-27vp-c3m5"
}
],
"release_date": "2026-03-25T19:43:40.969000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Access control bypass via unapplied ACLs in MQTT namespace"
},
{
"cve": "CVE-2026-33218",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-25T20:02:13.680355+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451450"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server, a high-performance messaging system. A remote attacker, by connecting to the leafnode port and sending a specially crafted malformed message before authentication, can cause the nats-server to crash. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33218"
},
{
"category": "external",
"summary": "RHBZ#2451450",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451450"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33218",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33218"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33218",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33218"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-10.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-10.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-vprv-35vv-q339"
}
],
"release_date": "2026-03-25T19:53:12.075000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "nats-server: github.com/nats-io/nats-server: NATS-Server: Denial of Service via malformed message pre-authentication on leafnode port"
},
{
"cve": "CVE-2026-33219",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-03-25T20:01:41.235854+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451445"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. A malicious client connecting to the WebSockets port can cause unbounded memory use before authentication by sending a large amount of data. This resource exhaustion vulnerability can lead to a Denial of Service (DoS) for the server, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33219"
},
{
"category": "external",
"summary": "RHBZ#2451445",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451445"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33219",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33219"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33219",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33219"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-02.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-02.txt"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-11.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-11.txt"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-qrvq-68c2-7grw",
"url": "https://github.com/advisories/GHSA-qrvq-68c2-7grw"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-8r68-gvr4-jh7j"
}
],
"release_date": "2026-03-25T19:55:28.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Denial of Service via unbounded memory use in WebSockets"
},
{
"cve": "CVE-2026-33247",
"cwe": {
"id": "CWE-214",
"name": "Invocation of Process Using Visible Sensitive Information"
},
"discovery_date": "2026-03-25T21:02:07.985713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451486"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in NATS-Server. If the NATS-Server is configured with static credentials provided through command-line arguments (argv) and the monitoring port is enabled, a remote attacker with access to the monitoring port can view these credentials. The /debug/vars endpoint on the monitoring port exposes an unredacted copy of the command-line arguments, leading to information disclosure of sensitive authentication details.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33247"
},
{
"category": "external",
"summary": "RHBZ#2451486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451486"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33247",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33247"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33247",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33247"
},
{
"category": "external",
"summary": "https://advisories.nats.io/CVE/secnote-2026-14.txt",
"url": "https://advisories.nats.io/CVE/secnote-2026-14.txt"
},
{
"category": "external",
"summary": "https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv",
"url": "https://github.com/nats-io/nats-server/security/advisories/GHSA-x6g4-f6q3-fqvv"
}
],
"release_date": "2026-03-25T20:02:18.868000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/nats-io/nats-server: NATS-Server: Information disclosure of credentials via monitoring port and command-line arguments"
},
{
"cve": "CVE-2026-33413",
"cwe": {
"id": "CWE-306",
"name": "Missing Authentication for Critical Function"
},
"discovery_date": "2026-03-26T14:03:01.896580+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451728"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in etcd, a distributed key-value store. Unauthorized users can bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients. This allows them to access sensitive cluster topology information, disrupt operations through alarms, interfere with lease management, and trigger data compaction, leading to permanent data loss and disruption of critical workflows. This vulnerability can result in information disclosure and denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "etcd: etcd: Authorization bypass allows information disclosure and denial of service",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw in etcd allows unauthorized users to bypass authentication or authorization checks when the gRPC API is exposed to untrusted clients and etcd\u0027s built-in authentication is enabled. This can lead to information disclosure and denial of service. Typical Red Hat OpenShift Container Platform and Kubernetes deployments are not affected, as the Kubernetes API server handles authentication and authorization independently of etcd\u0027s internal mechanisms.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33413"
},
{
"category": "external",
"summary": "RHBZ#2451728",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451728"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33413",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33413"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33413",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33413"
},
{
"category": "external",
"summary": "https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg",
"url": "https://github.com/etcd-io/etcd/security/advisories/GHSA-q8m4-xhhv-38mg"
}
],
"release_date": "2026-03-26T13:36:10.919000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Restrict network access to etcd server ports to ensure only trusted components can establish connections. Implement strong client identity at the transport layer, such as mTLS, with tightly scoped client certificate distribution. This will limit unauthorized access to etcd functions.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "etcd: etcd: Authorization bypass allows information disclosure and denial of service"
},
{
"cve": "CVE-2026-33487",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"discovery_date": "2026-03-26T18:02:32.278778+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2451814"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in goxmlsig, a Go library for XML Digital Signatures. This vulnerability arises from a programming error, specifically a loop variable capture issue, within the `validateSignature` function. When processing XML Digital Signatures, this error can cause the system to incorrectly validate the signature, potentially allowing an attacker to bypass integrity checks. This issue affects Go versions before 1.22 or projects using older `go.mod` configurations.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33487"
},
{
"category": "external",
"summary": "RHBZ#2451814",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451814"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33487",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33487"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33487"
},
{
"category": "external",
"summary": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc",
"url": "https://github.com/russellhaering/goxmldsig/security/advisories/GHSA-479m-364c-43vc"
}
],
"release_date": "2026-03-26T17:17:51.101000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/russellhaering/goxmldsig: goxmlsig: Integrity bypass due to incorrect XML Digital Signature validation via loop variable capture issue"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-33813",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-21T20:01:02.224363+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460221"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in golang.org/x/image. A remote attacker could exploit this vulnerability by providing a specially crafted WEBP image with an invalid, large size. This could cause the application to panic and crash on 32-bit platforms, leading to a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33813"
},
{
"category": "external",
"summary": "RHBZ#2460221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460221"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33813",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33813"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33813"
},
{
"category": "external",
"summary": "https://go.dev/cl/759860",
"url": "https://go.dev/cl/759860"
},
{
"category": "external",
"summary": "https://go.dev/issue/78407",
"url": "https://go.dev/issue/78407"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4961",
"url": "https://pkg.go.dev/vuln/GO-2026-4961"
}
],
"release_date": "2026-04-21T19:21:27.644000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang.org/x/image: golang: golang.org/x/image: Denial of Service via malformed WEBP image parsing"
},
{
"cve": "CVE-2026-33997",
"cwe": {
"id": "CWE-266",
"name": "Incorrect Privilege Assignment"
},
"discovery_date": "2026-03-31T03:01:29.529297+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, an open-source container framework. This vulnerability allows for a privilege validation bypass during `docker plugin install`. Due to an error in the daemon\u0027s privilege comparison logic, the system may incorrectly accept a plugin\u0027s requested privileges that differ from those approved by the user. This could lead to unauthorized privilege escalation for installed plugins.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "An important flaw in Moby, an open-source container framework, allows for a privilege validation bypass during `docker plugin install`. This issue stems from an error in the daemon\u0027s privilege comparison logic, which could lead to unauthorized privilege escalation for installed plugins. Red Hat products that leverage Moby and allow Docker plugin installation are affected.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33997"
},
{
"category": "external",
"summary": "RHBZ#2453277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33997",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33997"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33997",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33997"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9",
"url": "https://github.com/moby/moby/security/advisories/GHSA-pxq6-2prw-chj9"
}
],
"release_date": "2026-03-31T01:36:51.404000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation"
},
{
"cve": "CVE-2026-34040",
"cwe": {
"id": "CWE-807",
"name": "Reliance on Untrusted Inputs in a Security Decision"
},
"discovery_date": "2026-03-31T03:01:34.530713+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2453278"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Moby, an open-source container framework. This security vulnerability allows attackers to bypass authorization plugins (AuthZ), which are mechanisms designed to control access and permissions within the container environment. The bypass of these plugins can lead to unauthorized operations and potential compromise of the system\u0027s integrity and confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Moby: Moby: Authorization bypass vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34040"
},
{
"category": "external",
"summary": "RHBZ#2453278",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2453278"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34040",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34040"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34040"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/releases/tag/docker-v29.3.1",
"url": "https://github.com/moby/moby/releases/tag/docker-v29.3.1"
},
{
"category": "external",
"summary": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2",
"url": "https://github.com/moby/moby/security/advisories/GHSA-x744-4wpc-v9h2"
}
],
"release_date": "2026-03-31T01:36:48.205000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Moby: Moby: Authorization bypass vulnerability"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
},
{
"cve": "CVE-2026-40890",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-04-21T20:02:56.729456+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in github.com/gomarkdown/markdown, a Go library for parsing Markdown text and rendering as HTML. A remote attacker could exploit this vulnerability by providing a specially crafted malformed input. Specifically, input containing a \u0027\u003c\u0027 character not followed by a \u0027\u003e\u0027 character, when processed by the SmartypantsRenderer, can lead to an out-of-bounds read or a panic. This can result in a denial of service (DoS) for the application, making it unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service flaw affecting Red Hat products that utilize the `github.com/gomarkdown/markdown` library. The vulnerability occurs when the `SmartypantsRenderer` processes specially crafted malformed Markdown input containing an unclosed \u0027\u003c\u0027 character, leading to an out-of-bounds read or application panic. A successful exploitation may lead the application using the library unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-40890"
},
{
"category": "external",
"summary": "RHBZ#2460245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-40890",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-40890"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40890",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40890"
},
{
"category": "external",
"summary": "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778",
"url": "https://github.com/gomarkdown/markdown/commit/759bbc3e32073c3bc4e25969c132fc520eda2778"
},
{
"category": "external",
"summary": "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7",
"url": "https://github.com/gomarkdown/markdown/security/advisories/GHSA-77fj-vx54-gvh7"
}
],
"release_date": "2026-04-21T19:51:53.237000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/gomarkdown/markdown: github.com/gomarkdown/markdown: Denial of Service via malformed Markdown input"
},
{
"cve": "CVE-2026-41602",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:16.099816+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463407"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Apache Thrift TFramedTransport Go language implementation. This integer overflow or wraparound vulnerability could potentially allow an attacker to cause unexpected behavior or resource exhaustion, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41602"
},
{
"category": "external",
"summary": "RHBZ#2463407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463407"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41602",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41602"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41602"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/6",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/6"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:06.646000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/apache/thrift: Apache Thrift: Integer Overflow in TFramedTransport Go implementation"
},
{
"cve": "CVE-2026-41603",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-04-28T10:01:29.782287+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463411"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of server certificates, where the hostname presented in the certificate does not match the expected hostname. A remote attacker could exploit this to impersonate a legitimate server, potentially intercepting or altering sensitive communications and leading to unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41603"
},
{
"category": "external",
"summary": "RHBZ#2463411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41603",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41603"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41603"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/7",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/7"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:19:40.564000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Security Bypass via Improper Certificate Hostname Validation"
},
{
"cve": "CVE-2026-41604",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:47.903741+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463416"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability could allow an attacker to access memory outside of allocated bounds. This could lead to information disclosure or potentially a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41604"
},
{
"category": "external",
"summary": "RHBZ#2463416",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463416"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41604",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41604"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41604"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/5",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/5"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:13.996000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41605",
"cwe": {
"id": "CWE-190",
"name": "Integer Overflow or Wraparound"
},
"discovery_date": "2026-04-28T10:01:54.269412+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463418"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This integer overflow or wraparound vulnerability could potentially lead to unexpected behavior or resource exhaustion, which may impact the availability or integrity of the system. The exact consequences depend on how the overflow is triggered and handled within the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41605"
},
{
"category": "external",
"summary": "RHBZ#2463418",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463418"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41605",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41605"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41605"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/4",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/4"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:20:44.319000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Integer Overflow or Wraparound Vulnerability"
},
{
"cve": "CVE-2026-41606",
"cwe": {
"id": "CWE-606",
"name": "Unchecked Input for Loop Condition"
},
"discovery_date": "2026-04-28T10:01:19.136351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463408"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. An uncontrolled recursion vulnerability exists, which could allow a remote attacker to trigger a Denial of Service (DoS) condition. This occurs when the affected component processes specially crafted input, leading to excessive resource consumption and system unavailability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41606"
},
{
"category": "external",
"summary": "RHBZ#2463408",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463408"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41606",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41606"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41606"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/3",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/3"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:12.815000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Denial of Service via uncontrolled recursion"
},
{
"cve": "CVE-2026-41607",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-04-28T10:01:33.022623+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463412"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This out-of-bounds read vulnerability can lead to the disclosure of sensitive information or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41607"
},
{
"category": "external",
"summary": "RHBZ#2463412",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463412"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41607",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41607"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41607"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/2",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/2"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:21:48.502000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: apache.com/apache/thrift: Apache Thrift: Out-of-bounds Read vulnerability"
},
{
"cve": "CVE-2026-41636",
"cwe": {
"id": "CWE-776",
"name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
},
"discovery_date": "2026-04-28T10:01:03.992199+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2463404"
}
],
"notes": [
{
"category": "description",
"text": "Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings\n\nThis issue affects Apache Thrift: before 0.23.0.\n\nUsers are recommended to upgrade to version 0.23.0, which fixes the issue.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41636"
},
{
"category": "external",
"summary": "RHBZ#2463404",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463404"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41636",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41636"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41636"
},
{
"category": "external",
"summary": "http://www.openwall.com/lists/oss-security/2026/04/28/1",
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/1"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql",
"url": "https://lists.apache.org/thread/lb4j0zyd5f3g36cos0wql925przpnwql"
}
],
"release_date": "2026-04-28T09:22:14.639000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache.com/apache/thrift: Apache Thrift: Node.js skip() recursion"
},
{
"cve": "CVE-2026-43869",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-05-05T08:00:56.417384+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466660"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Thrift. This vulnerability involves improper validation of a certificate with a host mismatch, which could allow a remote attacker to bypass security checks. By presenting a specially crafted certificate, an attacker may impersonate a legitimate server or client. This could lead to a security bypass, potentially enabling unauthorized access or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"known_not_affected": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43869"
},
{
"category": "external",
"summary": "RHBZ#2466660",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466660"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43869",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43869"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43869"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r",
"url": "https://lists.apache.org/thread/3hsgl1b69wzq3ry39scqbv2dhyl3j52r"
}
],
"release_date": "2026-05-05T07:25:48.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-04T14:16:54+00:00",
"details": "For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:\n\nhttps://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.15/html/multicluster_global_hub/index",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23345"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:51353652e207a04ede5c7f0f11ddc82150f2ca79a110a5e85d8c6e13ccdfa8f5_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:564d1f145c46663a04b05f5210388c27e888714911bcafb19bfb8a88821becc6_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:7e1aeac1da9e9c9ac413b8f9380a911e89c4c81fe5dd38656bb301ddb0918ccf_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-agent-rhel9@sha256:ba4697a2a94a5bb6e4b5e5edeebe04f24125f910ae158d070cecf73374d959f0_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:05f069047e37620fa1ea72f0c0cbea205f27a4a4594c674b59d6dfa2a18f9f26_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:11e5a558fb1a9ecae142c55512fd4ab028b9162be4ae491f491ee030c6206194_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:76d186f4c2ffdf0d62399ff9f3c78bee536e9193647d571fcb2123743f163c50_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9@sha256:9a70b0f09751c7b595b2372275a7be806768632722b921ad828f2d30db9fedde_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:2b11ee4ff5d5a5dce7cd2c03b1cf088e27cf23816b1f5e9dfc11a136052a9542_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:56e32b74a97b5211573194b1358613d07fd967944c0bde22eb1f9b61ef1ff1b8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:a1dc9d34a9b9dd90eedec8b4bf5d246066ff8c964142376d190e72eca5eb6d03_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-manager-rhel9@sha256:f2784cac203f5ecb3d9de7f1312af0aa5ada9b673ab1c3188d839e1e13a3146b_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-operator-bundle@sha256:51bf429464a9e7f1b928bb60acb5cabc4491741884ac8e85fdee56092a2b03e8_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:07a4a707ac56ea0fb5b805e58e535cbd7503c71027ccb5a9a412e63ced8db831_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:1c2e24a5caf18deaf56a4f9e7bae8e013de18b64e3bad8560b959d595e11272e_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:556fff489ab3d6794c3cef4c10d09ceda194b02a9bf8a7bf1542e40802adeec6_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9@sha256:ff7d02b17b98ef8f65368c6b93e76e4ceb683411af5c3037484acb0508f31ea1_s390x",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:262ad6cee9e2176214103ecd866dd502d2d68b24b9f9be08e934f8fa3a285176_arm64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:3e619a5807582f6b5d7f50909667b9e0e3391f0166a3c322988d3b534f8cf103_amd64",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:d8b6bfdd948e9b0b423a240d2538eefa3bfd742635c27ee0db23c7af96657c4a_ppc64le",
"Multicluster Global Hub 1.6.2:registry.redhat.io/multicluster-globalhub/multicluster-globalhub-rhel9-operator@sha256:f9aab6b75117767d41e24dee791df45d42758c70c5d5ef6b435564e73b3c1d6f_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "Apache Thrift: Apache Thrift: Security bypass due to improper certificate validation"
}
]
}
RHSA-2026:26568
Vulnerability from csaf_redhat - Published: 2026-06-17 12:57 - Updated: 2026-08-21 17:45Summary
Red Hat Security Advisory: Red Hat OpenShift API for Data Protection
Severity
Important
Notes
Topic: A new version of OpenShift API for Data Protection (OADP) is now available.
Details: OpenShift API for Data Protection (OADP) enables you to back up and restore
application resources, persistent volume data, and internal container
images to external backup storage. OADP enables both file system-based and
snapshot-based backups for persistent volumes.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.
9.1 (Critical)
Affected products
Fixed
40 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
5 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.
8.2 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Vendor Fix
fix
Workaround
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Vendor Fix
fix
|
Known not affected
41 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — | ||
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
37 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 | — |
Workaround
|
|
| Unresolved product id: OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 | — |
Workaround
|
Threats
Impact
Important
References
81 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "A new version of OpenShift API for Data Protection (OADP) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "OpenShift API for Data Protection (OADP) enables you to back up and restore\napplication resources, persistent volume data, and internal container\nimages to external backup storage. OADP enables both file system-based and\nsnapshot-based backups for persistent volumes.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:26568",
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33186",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33747",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33748",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore",
"url": "https://docs.redhat.com/en/documentation/openshift_container_platform/latest/html/backup_and_restore/oadp-application-backup-and-restore"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26568.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift API for Data Protection",
"tracking": {
"current_release_date": "2026-08-21T17:45:20+00:00",
"generator": {
"date": "2026-08-21T17:45:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:26568",
"initial_release_date": "2026-06-17T12:57:45+00:00",
"revision_history": [
{
"date": "2026-06-17T12:57:45+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:45:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "OpenShift API for Data Protection 1.5",
"product": {
"name": "OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_api_data_protection:1.5::el9"
}
}
}
],
"category": "product_family",
"name": "OpenShift API for Data Protection"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1779244652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3A31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1779244923"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Af0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1779770057"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1779243495"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1779843906"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"product_id": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-operator-bundle@sha256%3A71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-operator-bundle\u0026tag=1779844974"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3Ac9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1779808027"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1779245274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3Ada0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1779244577"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1779244988"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1779244697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b?arch=amd64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1779243501"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1779244652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Acf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1779244923"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1779770057"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1779243495"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3Af1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1779843906"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3Af05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1779808027"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3A47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1779245274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1779244577"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3Ac1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1779244988"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Ab3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1779244697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48?arch=arm64\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1779243501"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3Afda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1779244652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Ac7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1779244923"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3A99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1779770057"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3A1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1779243495"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1779843906"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1779808027"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Abc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1779245274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3Ab3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1779244577"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1779244988"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3Aacb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1779244697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3A2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5?arch=s390x\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1779243501"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-hypershift-velero-plugin-rhel9@sha256%3A326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9\u0026tag=1779244652"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-kubevirt-velero-plugin-rhel9@sha256%3Ad2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9\u0026tag=1779244923"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-mustgather-rhel9@sha256%3Aac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-mustgather-rhel9\u0026tag=1779770057"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-non-admin-rhel9@sha256%3Affeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-non-admin-rhel9\u0026tag=1779243495"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-rhel9-operator@sha256%3A8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-rhel9-operator\u0026tag=1779843906"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-rhel9@sha256%3A0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-rhel9\u0026tag=1779808027"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-rhel9@sha256%3Aa7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-rhel9\u0026tag=1779245274"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-aws-rhel9@sha256%3A3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9\u0026tag=1779244577"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-gcp-rhel9@sha256%3A2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9\u0026tag=1779244988"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-legacy-aws-rhel9@sha256%3A39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9\u0026tag=1779244697"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"product": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"product_id": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256%3Affaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16?arch=ppc64le\u0026repository_url=registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9\u0026tag=1779243501"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64 as a component of OpenShift API for Data Protection 1.5",
"product_id": "OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
},
"product_reference": "registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64",
"relates_to_product_reference": "OpenShift API for Data Protection 1.5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"discovery_date": "2026-03-20T23:02:27.802640+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2449833"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in gRPC-Go, the Go language implementation of gRPC. This vulnerability, an authorization bypass, is caused by improper input validation of the HTTP/2 `:path` pseudo-header. A remote attacker can exploit this by sending raw HTTP/2 frames with a malformed `:path` that omits the mandatory leading slash. This allows the attacker to bypass defined security policies, potentially leading to unauthorized access to services or information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "RHBZ#2449833",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2449833"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33186",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33186"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3",
"url": "https://github.com/grpc/grpc-go/security/advisories/GHSA-p77j-4mvh-x3m3"
}
],
"release_date": "2026-03-20T22:23:32.147000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "To mitigate this issue, implement infrastructure-level normalization to ensure all incoming HTTP/2 `:path` headers are properly formatted with a leading slash before reaching the gRPC-Go server. This can be achieved by configuring a reverse proxy or API gateway to validate and normalize the `:path` header. Ensure that any such intermediary is properly configured and restarted to apply the changes, which may temporarily impact service availability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation"
},
{
"cve": "CVE-2026-33747",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T02:01:29.921765+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452076"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit, a toolkit for converting source code to build artifacts. An untrusted BuildKit frontend can be leveraged to craft a malicious API message, allowing files to be written outside of the designated BuildKit state directory. This vulnerability, which is a form of arbitrary file write, could enable an attacker to execute unauthorized code or escalate their privileges on the system. This issue arises when custom BuildKit frontends are used with specific configuration options.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33747"
},
{
"category": "external",
"summary": "RHBZ#2452076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452076"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33747",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33747"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33747"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4c29-8rgm-jvjj"
}
],
"release_date": "2026-03-27T00:49:06.165000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, avoid using untrusted BuildKit frontends. Restrict the use of custom BuildKit frontends to only those from verified and trusted sources. Do not specify untrusted frontends via `#syntax` or `--build-arg BUILDKIT_SYNTAX`.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend"
},
{
"cve": "CVE-2026-33748",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-03-27T15:02:00.107493+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2452271"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in BuildKit. Insufficient validation of Git URL fragment subdirectory components may allow a remote attacker to access files outside the checked-out Git repository root. This access is limited to files on the same mounted filesystem. This vulnerability could lead to unauthorized information disclosure.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33748"
},
{
"category": "external",
"summary": "RHBZ#2452271",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2452271"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33748",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33748"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33748"
},
{
"category": "external",
"summary": "https://docs.docker.com/build/concepts/context/#url-fragments",
"url": "https://docs.docker.com/build/concepts/context/#url-fragments"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/releases/tag/v0.28.1",
"url": "https://github.com/moby/buildkit/releases/tag/v0.28.1"
},
{
"category": "external",
"summary": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg",
"url": "https://github.com/moby/buildkit/security/advisories/GHSA-4vrq-3vrq-g6gg"
}
],
"release_date": "2026-03-27T14:00:21.200000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
],
"known_not_affected": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T12:57:45+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26568"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:04cd0a20d0f47d97111301293bdded1eb3c4b303c9276e39f00b61af649ef77e_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:326e5c4f290916e99455d128911cdebcc2f476128004e4b4df1903a1a621a366_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:5cc12932887111178da936ab430e9f16b7f710a4ae98c7f1e8698720624b0b6d_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-hypershift-velero-plugin-rhel9@sha256:fda6c87a82490205e0cf97028fe6750e5407b677fb4d0a38d9d3b95e8af396d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:31bb587a13b02aeda8a55639f800020d68e6e91d1e37a0346bc0c09819254940_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:c7707d79297ad9e86a6061721ddbbab1ad389482d2c9e894268e1ef09a5311cf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:cf1a0fdd87815165d037d8361af27a7caa6ba4d2236767a649dfbc62090940a9_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9@sha256:d2aa0a929a06d94eb17c23df9ba182ab0fa72c70cf67fc0144e4dfb3ea0c8e29_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:15a5dc9571818879988dfdc824ee63fdde8b1e7eb60ea3a6a80e0f8d7e35f07c_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:99ee1439b65c10715d8c68db82d34c940b35d49333e75206342c4071ac6b7ea9_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:ac6657db103d21fe3087af65ac5db65674808c076108e7e72d44f446a6c06fde_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-mustgather-rhel9@sha256:f0eeb401ff9af1cf1a1ec7f675af1b971d333b1b9a060f733583a0505ef755d6_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1011b71da5144aa87b41fad553e2595d37b0c00e84f3f9ef2fc5bc297c6c23b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:1ef599161ea817eaa39ae9122badc5947fcbfa734deecb1c508d64f381f52a3e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:5ce37061b7f2425eb90d2eabdb7d677213ce1a3ac70ef9388ded3d4d5ac0b745_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-non-admin-rhel9@sha256:ffeacd359cf277418e33a260740e4cb51e1ee2bf5e4cc9da70940099653e2115_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-operator-bundle@sha256:71d4d68dca0037032b54a9a0cb297ef5510f8527645e15fec482d38bef97c88b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:2c744015aa83e60af29a0f9afaf79b8989e30fbe0691b355a4934cbba8d875c7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:4f65efff92d7ca27642d56953725a881b0f5ec7c9e1e93665d071db125be6e99_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:8eacd52ce856b89c38ac209d4fc66bd8c3d196c54de6ad055edc1a8d39d9744c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-rhel9-operator@sha256:f1b973faeb4b97b79f94cb0d694f73bc90ba0d253fefadfd2b6c0a7994529ae4_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:3f7a2d92d75b52a54a9a75eb336bb0b4f31e1ad0e9f269f18ebad4975b9872c1_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:7fd8a157a73564f926e0ca1c5076745451a5b2746a93f0991bba14a0c29f6d14_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:b3aacb1ba2bc094bb4eee59348a9ff057c74944cbbf9fc9ab52d09d54c137a8b_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-aws-rhel9@sha256:da0495c5e76fec75eb6106b8926ab50b56fd6aa4171c008a16550c54aa32244e_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:2c490d9d3c4d176d8d8a396626525536cdd37236f9be86e73bb647cac9d07845_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7dbbe65df390d71e5af07b55c1768ccb716200a43e4af4a4c5613f538cf402ed_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:7f7f67f8c6975ffd963434a51078bc22588badff0dbbbc338b5d0245a48e5ccf_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-gcp-rhel9@sha256:c1e17277ad0857c83172bdda7f1d4ac583f85021306aa366c1bc1ac47ecd4f1a_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:39c9533ab8147da38dc1da75c842bdd9605c27e44e5bd6958216eb6c090aa2bc_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:765383ad0e9e62368e91b9ac4945d3f253f5cb5329bb531d725f34306e6ecad7_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:acb1707f8ad2165040856ff90282264e42f013cfead52cb5e2740eb471b884fc_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-legacy-aws-rhel9@sha256:b3da6df1cc941e1d2044429f1361fd5b37b108a8c2bf672296c37ac31d561bd8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:071c8c18a00c2762d439d3021888a21a63f326e62fa229ac2cb5be664bf23c48_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:1718e9188458574e6c33c73165d30078075fec0751044ef19affe99358f2960b_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:2b96f4912ed60316e9e914cc01ee7fd5af2293e22108c571cf0663e120a2e7d5_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-for-microsoft-azure-rhel9@sha256:ffaccfe0ee5b0acd0d1f1a07da6fec010c4ecbb6521df6852f22428b7f005c16_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:39d8fef61373de14483aad9c4723a410d0de00ee59063f804a23104279661911_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:47ab49d1e7a2175b06b1e73c79f1b98dc55778adc0638b6a6eb36bed0e7343b8_arm64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:a7dac46731507954f181d2a1766cda4d973ea07127757e1527a4ece7a09d3c1c_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-plugin-rhel9@sha256:bc1f7b04f4860fa4a8136331f541e9dd8497a16357e5b428c7fcdcc50f1241ee_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:0baee9f43009c32438afaf4a2578c4bbe6f13d941ebfd584ad9223269ceed20b_ppc64le",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:99ce5ccdbbe48df5c5323d8660e2609f24da8fe998dee969f0d555dad08aae5e_s390x",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:c9c234723ce4f834fe75e89636aedc7afc488d717439639728ab82dfe73ec4f8_amd64",
"OpenShift API for Data Protection 1.5:registry.redhat.io/oadp/oadp-velero-rhel9@sha256:f05cab7b47366dd652982905e2d9a5d4abcd0e1a5a2561b0d078c20e889e14cb_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:26585
Vulnerability from csaf_redhat - Published: 2026-06-17 13:40 - Updated: 2026-08-21 17:22Summary
Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.15
Severity
Important
Notes
Topic: Logging for Red Hat OpenShift - 6.0.15
Details: Red Hat OpenShift Logging 6.0.15 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Workaround
|
Threats
Impact
Important
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Threats
Impact
Important
A flaw was found in Go's `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.
5.9 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.
8.8 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Vendor Fix
fix
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — | ||
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Threats
Impact
Important
A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
30 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 | — |
Workaround
|
|
| Unresolved product id: Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x | — |
Workaround
|
Threats
Impact
Important
References
60 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Logging for Red Hat OpenShift - 6.0.15",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Logging 6.0.15 is a cluster-wide logging solution for OpenShift that collects and manages applications, infrastructure, and audit logs.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:26585",
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-25679",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-27137",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32280",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32281",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-32282",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-33810",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-34986",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_26585.json"
}
],
"title": "Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.0.15",
"tracking": {
"current_release_date": "2026-08-21T17:22:49+00:00",
"generator": {
"date": "2026-08-21T17:22:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:26585",
"initial_release_date": "2026-06-17T13:40:23+00:00",
"revision_history": [
{
"date": "2026-06-17T13:40:23+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:22:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Logging Subsystem for Red Hat OpenShift 6",
"product": {
"name": "Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:logging:6.0::el9"
}
}
}
],
"category": "product_family",
"name": "Logging Subsystem for Red Hat OpenShift"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1781192926"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-operator-bundle@sha256%3A6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-operator-bundle\u0026tag=1781196145"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1781192891"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3Ad35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1781192874"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1781193075"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1781192924"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"product_id": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"product_identification_helper": {
"purl": "pkg:oci/loki-operator-bundle@sha256%3A36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/loki-operator-bundle\u0026tag=1781196156"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1781192909"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Abbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1781192910"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6?arch=amd64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1781193225"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1781192926"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3A9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1781192891"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1781192874"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1781193075"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3Af635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1781192924"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3A1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1781192909"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Af0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1781192910"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34?arch=arm64\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1781193225"
}
}
}
],
"category": "architecture",
"name": "arm64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3A82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1781192926"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3Aa13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1781192891"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1781192874"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1781193075"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1781192924"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Aee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1781192909"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Ace9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1781192910"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3Ae80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2?arch=s390x\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1781193225"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/cluster-logging-rhel9-operator@sha256%3Ab166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator\u0026tag=1781192926"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/eventrouter-rhel9@sha256%3Ad591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/eventrouter-rhel9\u0026tag=1781192891"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/log-file-metric-exporter-rhel9@sha256%3A12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9\u0026tag=1781192874"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/logging-loki-rhel9@sha256%3A350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/logging-loki-rhel9\u0026tag=1781193075"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/loki-rhel9-operator@sha256%3A0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/loki-rhel9-operator\u0026tag=1781192924"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/lokistack-gateway-rhel9@sha256%3Aae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/lokistack-gateway-rhel9\u0026tag=1781192909"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/opa-openshift-rhel9@sha256%3Af75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/opa-openshift-rhel9\u0026tag=1781192910"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"product": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"product_id": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/vector-rhel9@sha256%3A732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift-logging/vector-rhel9\u0026tag=1781193225"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64 as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x as a component of Logging Subsystem for Red Hat OpenShift 6",
"product_id": "Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
},
"product_reference": "registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x",
"relates_to_product_reference": "Logging Subsystem for Red Hat OpenShift 6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-25679",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-03-06T22:02:11.567841+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445356"
}
],
"notes": [
{
"category": "description",
"text": "The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "net/url: Incorrect parsing of IPv6 host literals in net/url",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-25679"
},
{
"category": "external",
"summary": "RHBZ#2445356",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445356"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-25679",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25679"
},
{
"category": "external",
"summary": "https://go.dev/cl/752180",
"url": "https://go.dev/cl/752180"
},
{
"category": "external",
"summary": "https://go.dev/issue/77578",
"url": "https://go.dev/issue/77578"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4601",
"url": "https://pkg.go.dev/vuln/GO-2026-4601"
}
],
"release_date": "2026-03-06T21:28:14.211000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "net/url: Incorrect parsing of IPv6 host literals in net/url"
},
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32281",
"cwe": {
"id": "CWE-1050",
"name": "Excessive Platform Resource Consumption within a Loop"
},
"discovery_date": "2026-04-08T02:01:00.930989+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456333"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go\u0027s `crypto/x509` package. A remote attacker could exploit this by presenting a specially crafted certificate chain containing a large number of policy mappings. This inefficient validation process consumes excessive resources, which can lead to a denial of service (DoS) for applications or systems performing certificate validation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw occurs during the validation of otherwise trusted certificate chains that contain a large number of policy mappings, leading to excessive resource consumption. Exploitation requires an attacker to present a specially crafted, yet trusted, certificate chain which would require the attacker has already compromised a trusted certificate root. Red Hat continuously monitors certificate authorities and curates the set which is trusted by default for Red Hat products.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32281"
},
{
"category": "external",
"summary": "RHBZ#2456333",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456333"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32281",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32281"
},
{
"category": "external",
"summary": "https://go.dev/cl/758061",
"url": "https://go.dev/cl/758061"
},
{
"category": "external",
"summary": "https://go.dev/issue/78281",
"url": "https://go.dev/issue/78281"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4946",
"url": "https://pkg.go.dev/vuln/GO-2026-4946"
}
],
"release_date": "2026-04-08T01:06:58.354000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-33810",
"cwe": {
"id": "CWE-1289",
"name": "Improper Validation of Unsafe Equivalence in Input"
},
"discovery_date": "2026-04-08T02:01:09.100830+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456335"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/x509` package within Go (golang). When verifying a certificate chain, excluded DNS (Domain Name System) constraints are not correctly applied to wildcard DNS Subject Alternative Names (SANs) if the case of the SAN differs from the constraint. This oversight could allow an attacker to bypass certificate validation, potentially leading to the acceptance of a malicious certificate that should have been rejected. This issue specifically impacts the validation of trusted certificate chains.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw in the Go `crypto/x509` package that could allow an attacker to bypass certificate validation. The vulnerability arises from an incorrect application of excluded DNS constraints to wildcard DNS Subject Alternative Names (SANs) when their case differs from the constraint. This could lead to Red Hat products accepting malicious certificates from otherwise trusted chains, compromising the trust model.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-33810"
},
{
"category": "external",
"summary": "RHBZ#2456335",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456335"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-33810",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33810"
},
{
"category": "external",
"summary": "https://go.dev/cl/763763",
"url": "https://go.dev/cl/763763"
},
{
"category": "external",
"summary": "https://go.dev/issue/78332",
"url": "https://go.dev/issue/78332"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4866",
"url": "https://pkg.go.dev/vuln/GO-2026-4866"
}
],
"release_date": "2026-04-08T01:06:56.546000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application"
},
{
"cve": "CVE-2026-34986",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-06T17:01:34.639203+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2455470"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Go JOSE, a library for handling JSON Web Encryption (JWE) objects. A remote attacker could exploit this vulnerability by providing a specially crafted JWE object. When decrypting such an object, if a key wrapping algorithm is specified but the encrypted key field is empty, the application can crash. This leads to a denial of service (DoS), making the affected service unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x"
],
"known_not_affected": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "RHBZ#2455470",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455470"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-34986",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34986"
},
{
"category": "external",
"summary": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8",
"url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-78h2-9frx-2jm8"
},
{
"category": "external",
"summary": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants",
"url": "https://pkg.go.dev/github.com/go-jose/go-jose/v4#pkg-constants"
}
],
"release_date": "2026-04-06T16:22:45.353000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-17T13:40:23+00:00",
"details": "For OpenShift Container Platform 4.16 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:\n\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.16/html/release_notes/ocp-4-16-release-notes\n\nFor Red Hat OpenShift Logging 6.0, see the following instructions to apply this update:\n\nhttps://docs.redhat.com/en/documentation/red_hat_openshift_logging/6.0",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:26585"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-operator-bundle@sha256:6f4dbc7f3632ae47eb17aa2ce9e336e6e7710ac1fbfcb4c894012a98819b78ca_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:56fa9c22636ebd58eb0fdfcb85895913b9d06c5c0497603a3beff5e5bebf9eb9_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:7d3c7fea6ca43095f8b4bd8cd6e7e5aea6aa2d910a0a65f4491bfb3aac0256da_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:82a08bc9410eaa8f27ab05aff287763e2e70611fb8cac4aedb2c864cb1ee44cb_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator@sha256:b166bced3166496816f40414c18d281e5628b17d151b588ec922e92c9e63f3c7_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:8395c91f0f78efd970aa266afbfd507a2f811fa77b0f110e417371f217f485b0_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:9049f1ba021aa03467478e05352c39ed1aa1289e88617d2ba7e6a9c1baa05b30_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:a13d9dd8d1bb24802e3c126e3d2f9f2f2f198d663c0946d53da3e7cf6e5e6594_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/eventrouter-rhel9@sha256:d591290a85cc270295de4ebcedf7b0f4c5007f51a22d2a6367e69add9c7249d6_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:12eb0a87d3da10cf10cd734d031000b5aba503d243ba8bcdfe12a7e6d775c350_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:3a280f9e6d1b301e829de78b22b5a9ac93f02818327d873f300da055628c966c_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:9c5897a18b1a166ae26c17db401bc958cdc7a4a69adc4a0ff814b372ad2a3f93_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/log-file-metric-exporter-rhel9@sha256:d35ece1b60c6649b54534c9b11fea3b53f3a4e742a2ade0a07e6a28307414ed8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:350f5c0350d2e3735209797b55586300278474b085fd8de797603851d74252fa_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:66c870df2255862b975babe3fca6dee83b948db90b0f739ed3ee002b7fcfb90b_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:8f3b6f87de69f0cbf60fcf7b07a115c925284c2ed95e438694e6d5282e518be2_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/logging-loki-rhel9@sha256:9f95efc1f2d811a2ce855ee1387977f50548472f3bc08b46d814b65ba398ccaf_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-operator-bundle@sha256:36742ce39ffd92b07cf02a7f51ade042862320d4b0beee09f6f0a71a23d1e724_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:0813ad39035209eac48727d10da0770d5d0e0fe94f84ed8ed0a7cb946fd5085a_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:69a9234a530751f1e7e34bfb21a8a79b7e3db6a7902722486f72b85bfc7b8cc3_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:7c561f6ea0662b5a7bde51ff65019c128b65bfefe3f1388e23669a6ffd130c9f_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/loki-rhel9-operator@sha256:f635ba63420aca986bd1f6a057b778c49957f26342df18849ff4b99fd318ac9f_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:1af5b63614997f6be796b2774d2031ebc3404d68440460f0edd9ecb7024e5a8d_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:54790ceaf3aa3bf15641c4ce1a0b8a5c0bea597e15e240cdf1c2d3715cd819e8_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ae2bb75f3c8e3c42cb22622114c63a67fc98a844bf10b313afed13afa7b3297d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/lokistack-gateway-rhel9@sha256:ee7c050cbd350c8ed01594fd3c7662c361b16a23ad6ef54ad1aefae7788729a8_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:bbe422b9d9e942072164a42c4ab57053867bc62cba0ddf53f7e7eac56ef53cd7_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:ce9658374396ecd1c9921e4ec4bd33eede25bb83568e0b401b6f9d1a053f58e4_s390x",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f0a4742ef2ba98180910b76006c356e77325d8f12741459db4f065835aad2d2a_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/opa-openshift-rhel9@sha256:f75b0b4ee4721d4424ece1becab440719c30f9385d3abd67cc2c75e7b56f0c7f_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:0e33e09065da575886194b76f1bd46cf1a435e036db6fc9511e8ff2ee27b8bc6_amd64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:732875c0ed445bb2708e870d3f561d6dc5a36c80cc42ebf63f4c30ae7674396d_ppc64le",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:80bf91b17c814c4bc5b8ddcb0aaeb252089067e7d0590d00afbaa175f5500e34_arm64",
"Logging Subsystem for Red Hat OpenShift 6:registry.redhat.io/openshift-logging/vector-rhel9@sha256:e80901561adb7ba09db77b3cc8aa7a754ce078370ef0507064fee60ff448d3d2_s390x"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object"
}
]
}
RHSA-2026:28038
Vulnerability from csaf_redhat - Published: 2026-06-22 20:40 - Updated: 2026-08-21 17:12Summary
Red Hat Security Advisory: gvisor-tap-vsock security update
Severity
Important
Notes
Topic: An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details: A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.
Security Fix(es):
* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.
7.8 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Moderate
A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).
7.5 (High)
Affected products
Fixed
21 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64 | — |
Vendor Fix
fix
|
Threats
Impact
Important
References
37 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for gvisor-tap-vsock is now available for Red Hat Enterprise Linux 9.6 Extended Update Support.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.\n\nSecurity Fix(es):\n\n* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)\n\n* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)\n\n* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)\n\n* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:28038",
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_28038.json"
}
],
"title": "Red Hat Security Advisory: gvisor-tap-vsock security update",
"tracking": {
"current_release_date": "2026-08-21T17:12:52+00:00",
"generator": {
"date": "2026-08-21T17:12:52+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:28038",
"initial_release_date": "2026-06-22T20:40:03+00:00",
"revision_history": [
{
"date": "2026-06-22T20:40:03+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-22T20:40:03+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T17:12:52+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product": {
"name": "Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_eus:9.6::appstream"
}
}
}
],
"category": "product_family",
"name": "Red Hat Enterprise Linux"
},
{
"branches": [
{
"category": "product_version",
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"product": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"product_id": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock@0.8.5-2.el9_6.2?arch=src\u0026epoch=6"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"product": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"product_id": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock@0.8.5-2.el9_6.2?arch=aarch64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"product_id": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder@0.8.5-2.el9_6.2?arch=aarch64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"product": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"product_id": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debugsource@0.8.5-2.el9_6.2?arch=aarch64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product_id": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debuginfo@0.8.5-2.el9_6.2?arch=aarch64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product_id": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder-debuginfo@0.8.5-2.el9_6.2?arch=aarch64\u0026epoch=6"
}
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"product": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"product_id": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock@0.8.5-2.el9_6.2?arch=ppc64le\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"product_id": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder@0.8.5-2.el9_6.2?arch=ppc64le\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"product": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"product_id": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debugsource@0.8.5-2.el9_6.2?arch=ppc64le\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product_id": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debuginfo@0.8.5-2.el9_6.2?arch=ppc64le\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product_id": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder-debuginfo@0.8.5-2.el9_6.2?arch=ppc64le\u0026epoch=6"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"product": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"product_id": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock@0.8.5-2.el9_6.2?arch=x86_64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"product_id": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder@0.8.5-2.el9_6.2?arch=x86_64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"product": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"product_id": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debugsource@0.8.5-2.el9_6.2?arch=x86_64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product_id": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debuginfo@0.8.5-2.el9_6.2?arch=x86_64\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product_id": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder-debuginfo@0.8.5-2.el9_6.2?arch=x86_64\u0026epoch=6"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"product": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"product_id": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock@0.8.5-2.el9_6.2?arch=s390x\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"product_id": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder@0.8.5-2.el9_6.2?arch=s390x\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"product": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"product_id": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debugsource@0.8.5-2.el9_6.2?arch=s390x\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product_id": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-debuginfo@0.8.5-2.el9_6.2?arch=s390x\u0026epoch=6"
}
}
},
{
"category": "product_version",
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product_id": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/gvisor-tap-vsock-gvforwarder-debuginfo@0.8.5-2.el9_6.2?arch=s390x\u0026epoch=6"
}
}
}
],
"category": "architecture",
"name": "s390x"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64"
},
"product_reference": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le"
},
"product_reference": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x"
},
"product_reference": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src"
},
"product_reference": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64"
},
"product_reference": "gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64"
},
"product_reference": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le"
},
"product_reference": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x"
},
"product_reference": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
},
"product_reference": "gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64"
},
"product_reference": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le"
},
"product_reference": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x"
},
"product_reference": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64"
},
"product_reference": "gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64 as a component of Red Hat Enterprise Linux AppStream EUS (v.9.6)",
"product_id": "AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
},
"product_reference": "gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"relates_to_product_reference": "AppStream-9.6.0.Z.EUS"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-27137",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"discovery_date": "2026-03-06T22:01:38.859733+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2445345"
}
],
"notes": [
{
"category": "description",
"text": "A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-27137"
},
{
"category": "external",
"summary": "RHBZ#2445345",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2445345"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-27137",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-27137"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-27137"
},
{
"category": "external",
"summary": "https://go.dev/cl/752182",
"url": "https://go.dev/cl/752182"
},
{
"category": "external",
"summary": "https://go.dev/issue/77952",
"url": "https://go.dev/issue/77952"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk",
"url": "https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4599",
"url": "https://pkg.go.dev/vuln/GO-2026-4599"
}
],
"release_date": "2026-03-06T21:28:13.748000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-22T20:40:03+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: Incorrect enforcement of email constraints in crypto/x509"
},
{
"cve": "CVE-2026-32280",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-04-08T02:01:19.572351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456339"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the Go standard library packages `crypto/x509` and `crypto/tls`. During the process of building a certificate chain, an attacker can provide a large number of intermediate certificates. This excessive input is not properly limited, leading to an uncontrolled amount of work being performed. This can result in a denial of service (DoS) condition, making the affected system or application unavailable to legitimate users.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in the Go standard library\u0027s certificate chain building process. Systems utilizing Go applications that process untrusted TLS certificates or X.509 certificate chains are susceptible to resource exhaustion when presented with an excessive number of intermediate certificates, potentially leading to service unavailability. This flaw impacts applications directly using `crypto/x509` or `crypto/tls`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32280"
},
{
"category": "external",
"summary": "RHBZ#2456339",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456339"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32280",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32280"
},
{
"category": "external",
"summary": "https://go.dev/cl/758320",
"url": "https://go.dev/cl/758320"
},
{
"category": "external",
"summary": "https://go.dev/issue/78282",
"url": "https://go.dev/issue/78282"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4947",
"url": "https://pkg.go.dev/vuln/GO-2026-4947"
}
],
"release_date": "2026-04-08T01:06:58.595000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-22T20:40:03+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building"
},
{
"cve": "CVE-2026-32282",
"cwe": {
"id": "CWE-367",
"name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
},
"discovery_date": "2026-04-08T02:01:12.683211+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456336"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the internal/syscall/unix package in the Go standard library. If the target of the `Root.Chmod` function is replaced with a symbolic link during execution, specifically after `Root.Chmod` checks the target but before acting, the `chmod` operation will be performed on the file the symbolic link points to. This issue can bypass directory restrictions and lead to unauthorized permission changes on the filesystem.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker needs access to the system and the required permissions to create a symbolic link. Additionally, the attacker must swap the target file with a symbolic link in the exact window after the `Root.Chmod` function checks its target but before acting. Due to these conditions, this flaw has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32282"
},
{
"category": "external",
"summary": "RHBZ#2456336",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456336"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32282",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32282"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32282"
},
{
"category": "external",
"summary": "https://go.dev/cl/763761",
"url": "https://go.dev/cl/763761"
},
{
"category": "external",
"summary": "https://go.dev/issue/78293",
"url": "https://go.dev/issue/78293"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4864",
"url": "https://pkg.go.dev/vuln/GO-2026-4864"
}
],
"release_date": "2026-04-08T01:06:55.953000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-22T20:40:03+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root"
},
{
"cve": "CVE-2026-32283",
"cwe": {
"id": "CWE-764",
"name": "Multiple Locks of a Critical Resource"
},
"discovery_date": "2026-04-08T02:01:16.213799+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2456338"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `crypto/tls` package within the Go (golang) standard library, specifically affecting TLS 1.3 connections. A remote attacker can exploit this vulnerability by sending multiple key update messages in a single record after the handshake. This can cause the connection to deadlock, leading to uncontrolled consumption of resources and ultimately a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in the Go `crypto/tls` package allows a remote attacker to cause a denial of service in applications using TLS 1.3. By sending multiple key update messages in a single record post-handshake, an attacker can trigger a connection deadlock, leading to uncontrolled resource consumption. This impacts Red Hat products utilizing the affected Go standard library for TLS 1.3 connections.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-32283"
},
{
"category": "external",
"summary": "RHBZ#2456338",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2456338"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-32283",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32283"
},
{
"category": "external",
"summary": "https://go.dev/cl/763767",
"url": "https://go.dev/cl/763767"
},
{
"category": "external",
"summary": "https://go.dev/issue/78334",
"url": "https://go.dev/issue/78334"
},
{
"category": "external",
"summary": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU",
"url": "https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"
},
{
"category": "external",
"summary": "https://pkg.go.dev/vuln/GO-2026-4870",
"url": "https://pkg.go.dev/vuln/GO-2026-4870"
}
],
"release_date": "2026-04-08T01:06:57.670000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-22T20:40:03+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:28038"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.src",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debuginfo-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-debugsource-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-6:0.8.5-2.el9_6.2.x86_64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.aarch64",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.ppc64le",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.s390x",
"AppStream-9.6.0.Z.EUS:gvisor-tap-vsock-gvforwarder-debuginfo-6:0.8.5-2.el9_6.2.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…